commit 87f3d592d92f
Author: Boris Zbarsky <bzbarsky@mit.edu>
Date: Mon Oct 9 14:49:19 2017 -0400
Bug 1405878 - Make sure to notify for our kids, if needed, before calling DoneAddingChildren in the XML content sink. r=hsivonen, a=sledru
Once we call DoneAddingChildren, random code of various sorts will run, which
can flush our notification state. If that happens before we've notified on our
kids, but after we've popped the element we're closing off the element stack,
we will fail to ever notify on the kids.
MozReview-Commit-ID: Ei7v5OobX8R
--HG--
extra : source : f144e1434312485cf9ee16a36d6159dbcb13a07d
---
dom/xml/crashtests/1405878.xml | 11 +++++++++++
dom/xml/crashtests/crashtests.list | 1 +
dom/xml/nsXMLContentSink.cpp | 18 +++++++++++-------
layout/reftests/bugs/1405878-1-ref.xml | 7 +++++++
layout/reftests/bugs/1405878-1.xml | 6 ++++++
layout/reftests/bugs/reftest.list | 1 +
6 files changed, 37 insertions(+), 7 deletions(-)
diff --git dom/xml/crashtests/1405878.xml dom/xml/crashtests/1405878.xml
new file mode 100644
index 000000000000..12677ade938d
--- /dev/null
+++ dom/xml/crashtests/1405878.xml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <body>
+ <select>
+ <script>document.documentElement.offsetHeight</script>
+ <option>Hello there</option>
+ </select>
+ <script>
+ document.querySelector("body").style.display = "inline";
+ </script>
+ </body>
+</html>
diff --git dom/xml/crashtests/crashtests.list dom/xml/crashtests/crashtests.list
index f18767d582c2..2c06ffc545ec 100644
--- dom/xml/crashtests/crashtests.list
+++ dom/xml/crashtests/crashtests.list
@@ -10,3 +10,4 @@ load 453278.html
load 803586.xhtml
load 994740-1.xhtml
load 1038887.xhtml
+load 1405878.xml
diff --git dom/xml/nsXMLContentSink.cpp dom/xml/nsXMLContentSink.cpp
index 2593519aa44b..b04977d62cf1 100644
--- dom/xml/nsXMLContentSink.cpp
+++ dom/xml/nsXMLContentSink.cpp
@@ -1071,6 +1071,17 @@ nsXMLContentSink::HandleEndElement(const char16_t *aName,
isTemplateElement, "Wrong element being closed");
#endif
+ // Make sure to notify on our kids before we call out to any other code that
+ // might reenter us and call FlushTags, in a state in which we've already
+ // popped "content" from the stack but haven't notified on its kids yet.
+ int32_t stackLen = mContentStack.Length();
+ if (mNotifyLevel >= stackLen) {
+ if (numFlushed < content->GetChildCount()) {
+ NotifyAppend(content, numFlushed);
+ }
+ mNotifyLevel = stackLen - 1;
+ }
+
result = CloseElement(content);
if (mCurrentHead == content) {
@@ -1086,13 +1097,6 @@ nsXMLContentSink::HandleEndElement(const char16_t *aName,
MaybeStartLayout(false);
}
- int32_t stackLen = mContentStack.Length();
- if (mNotifyLevel >= stackLen) {
- if (numFlushed < content->GetChildCount()) {
- NotifyAppend(content, numFlushed);
- }
- mNotifyLevel = stackLen - 1;
- }
DidAddContent();
if (content->IsSVGElement(nsGkAtoms::svg)) {
diff --git layout/reftests/bugs/1405878-1-ref.xml layout/reftests/bugs/1405878-1-ref.xml
new file mode 100644
index 000000000000..6d1dd199b41e
--- /dev/null
+++ layout/reftests/bugs/1405878-1-ref.xml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <select>
+ <script>document.documentElement.offsetHeight</script>
+ <option>Hello there</option>
+ <script>document.documentElement.offsetHeight</script>
+ </select>
+</html>
diff --git layout/reftests/bugs/1405878-1.xml layout/reftests/bugs/1405878-1.xml
new file mode 100644
index 000000000000..3915711b1103
--- /dev/null
+++ layout/reftests/bugs/1405878-1.xml
@@ -0,0 +1,6 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <select>
+ <script>document.documentElement.offsetHeight</script>
+ <option>Hello there</option>
+ </select>
+</html>
diff --git layout/reftests/bugs/reftest.list layout/reftests/bugs/reftest.list
index 52f8cb915cee..47c04cdf41d6 100644
--- layout/reftests/bugs/reftest.list
+++ layout/reftests/bugs/reftest.list
@@ -2037,3 +2037,4 @@ needs-focus != 1377447-1.html 1377447-2.html
== 1380224-1.html 1380224-1-ref.html
== 1384065.html 1384065-ref.html
== 1384275-1.html 1384275-1-ref.html
+== 1405878-1.xml 1405878-1-ref.xml
