Attachment #526410 for bug #604262

Attachment #526410: Fix for 1.9.1 for bug #604262

View | Details | Raw Unified | Return to bug 604262
Collapse All | Expand All

(-)a/content/base/src/nsImageLoadingContent.cpp (-1 / +36 lines)

Line	Link Here

Lines 163-175 nsImageLoadingContent::FrameChanged(imgI	Link Here

163

  LOOP_OVER_OBSERVERS(FrameChanged(aContainer, aFrame, aDirtyRect));

163

  LOOP_OVER_OBSERVERS(FrameChanged(aContainer, aFrame, aDirtyRect));

164

  return NS_OK;

164

  return NS_OK;

165

166

167

/*

167

/*

168

 * imgIDecoderObserver impl

168

 * imgIDecoderObserver impl

169

*/

169

*/

170

NS_IMETHODIMP

170

NS_IMETHODIMP

171

nsImageLoadingContent::OnStartRequest(imgIRequest* aRequest)

171

nsImageLoadingContent::OnStartRequest(imgIRequest* aRequest)

172

173

  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);

174

173

  LOOP_OVER_OBSERVERS(OnStartRequest(aRequest));

175

  LOOP_OVER_OBSERVERS(OnStartRequest(aRequest));

174

  return NS_OK;

176

  return NS_OK;

175

177

Lines 177-182 nsImageLoadingContent::OnStartRequest(im	Link Here

177

NS_IMETHODIMP

179

NS_IMETHODIMP

178

nsImageLoadingContent::OnStartDecode(imgIRequest* aRequest)

180

nsImageLoadingContent::OnStartDecode(imgIRequest* aRequest)

179

181

182

  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);

183

180

  LOOP_OVER_OBSERVERS(OnStartDecode(aRequest));

184

  LOOP_OVER_OBSERVERS(OnStartDecode(aRequest));

181

  return NS_OK;

185

  return NS_OK;

182

186

Lines 185-190 NS_IMETHODIMP	Link Here

185

nsImageLoadingContent::OnStartContainer(imgIRequest* aRequest,

189

nsImageLoadingContent::OnStartContainer(imgIRequest* aRequest,

186

                                        imgIContainer* aContainer)

190

                                        imgIContainer* aContainer)

187

191

192

  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);

193

188

  LOOP_OVER_OBSERVERS(OnStartContainer(aRequest, aContainer));

194

  LOOP_OVER_OBSERVERS(OnStartContainer(aRequest, aContainer));

189

195

190

  // Have to check for state changes here, since we might have been in

196

  // Have to check for state changes here, since we might have been in

Lines 197-202 NS_IMETHODIMP	Link Here

197

nsImageLoadingContent::OnStartFrame(imgIRequest* aRequest,

203

nsImageLoadingContent::OnStartFrame(imgIRequest* aRequest,

198

                                    gfxIImageFrame* aFrame)

204

                                    gfxIImageFrame* aFrame)

199

205

206

  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);

207

200

  LOOP_OVER_OBSERVERS(OnStartFrame(aRequest, aFrame));

208

  LOOP_OVER_OBSERVERS(OnStartFrame(aRequest, aFrame));

201

  return NS_OK;

209

  return NS_OK;

202

210

Lines 206-211 nsImageLoadingContent::OnDataAvailable(i	Link Here

206

                                       gfxIImageFrame* aFrame,

214

                                       gfxIImageFrame* aFrame,

207

                                       const nsRect* aRect)

215

                                       const nsRect* aRect)

208

216

217

  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);

218

209

  LOOP_OVER_OBSERVERS(OnDataAvailable(aRequest, aFrame, aRect));

219

  LOOP_OVER_OBSERVERS(OnDataAvailable(aRequest, aFrame, aRect));

210

  return NS_OK;

220

  return NS_OK;

211

221

Lines 214-219 NS_IMETHODIMP	Link Here

214

nsImageLoadingContent::OnStopFrame(imgIRequest* aRequest,

224

nsImageLoadingContent::OnStopFrame(imgIRequest* aRequest,

215

                                   gfxIImageFrame* aFrame)

225

                                   gfxIImageFrame* aFrame)

216

226

227

  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);

228

217

  LOOP_OVER_OBSERVERS(OnStopFrame(aRequest, aFrame));

229

  LOOP_OVER_OBSERVERS(OnStopFrame(aRequest, aFrame));

218

  return NS_OK;

230

  return NS_OK;

219

231

Lines 222-227 NS_IMETHODIMP	Link Here

222

nsImageLoadingContent::OnStopContainer(imgIRequest* aRequest,

234

nsImageLoadingContent::OnStopContainer(imgIRequest* aRequest,

223

                                       imgIContainer* aContainer)

235

                                       imgIContainer* aContainer)

224

236

237

  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);

238

225

  LOOP_OVER_OBSERVERS(OnStopContainer(aRequest, aContainer));

239

  LOOP_OVER_OBSERVERS(OnStopContainer(aRequest, aContainer));

226

  return NS_OK;

240

  return NS_OK;

227

241

Lines 233-238 nsImageLoadingContent::OnStopDecode(imgI	Link Here

233

247

234

  NS_PRECONDITION(aRequest == mCurrentRequest || aRequest == mPendingRequest,

248

  NS_PRECONDITION(aRequest == mCurrentRequest || aRequest == mPendingRequest,

235

                  "Unknown request");

249

                  "Unknown request");

250

251

  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);

252

236

  LOOP_OVER_OBSERVERS(OnStopDecode(aRequest, aStatus, aStatusArg));

253

  LOOP_OVER_OBSERVERS(OnStopDecode(aRequest, aStatus, aStatusArg));

237

254

238

  if (aRequest == mPendingRequest) {

255

  if (aRequest == mPendingRequest) {

Lines 264-269 nsImageLoadingContent::OnStopDecode(imgI	Link Here

264

NS_IMETHODIMP

281

NS_IMETHODIMP

265

nsImageLoadingContent::OnStopRequest(imgIRequest* aRequest, PRBool aLastPart)

282

nsImageLoadingContent::OnStopRequest(imgIRequest* aRequest, PRBool aLastPart)

266

283

284

  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);

285

267

  LOOP_OVER_OBSERVERS(OnStopRequest(aRequest, aLastPart));

286

  LOOP_OVER_OBSERVERS(OnStopRequest(aRequest, aLastPart));

268

287

269

  return NS_OK;

288

  return NS_OK;

Lines 276-281 nsImageLoadingContent::OnStopRequest(img	Link Here

276

NS_IMETHODIMP

295

NS_IMETHODIMP

277

nsImageLoadingContent::GetLoadingEnabled(PRBool *aLoadingEnabled)

296

nsImageLoadingContent::GetLoadingEnabled(PRBool *aLoadingEnabled)

278

297

298

  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);

299

279

  *aLoadingEnabled = mLoadingEnabled;

300

  *aLoadingEnabled = mLoadingEnabled;

280

  return NS_OK;

301

  return NS_OK;

281

302

Lines 283-288 nsImageLoadingContent::GetLoadingEnabled	Link Here

283

NS_IMETHODIMP

304

NS_IMETHODIMP

284

nsImageLoadingContent::SetLoadingEnabled(PRBool aLoadingEnabled)

305

nsImageLoadingContent::SetLoadingEnabled(PRBool aLoadingEnabled)

285

306

307

  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);

308

286

  if (nsContentUtils::GetImgLoader()) {

309

  if (nsContentUtils::GetImgLoader()) {

287

    mLoadingEnabled = aLoadingEnabled;

310

    mLoadingEnabled = aLoadingEnabled;

288

311

Lines 292-297 nsImageLoadingContent::SetLoadingEnabled	Link Here

292

NS_IMETHODIMP

315

NS_IMETHODIMP

293

nsImageLoadingContent::GetImageBlockingStatus(PRInt16* aStatus)

316

nsImageLoadingContent::GetImageBlockingStatus(PRInt16* aStatus)

294

317

318

  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);

319

295

  NS_PRECONDITION(aStatus, "Null out param");

320

  NS_PRECONDITION(aStatus, "Null out param");

296

  *aStatus = mImageBlockingStatus;

321

  *aStatus = mImageBlockingStatus;

297

  return NS_OK;

322

  return NS_OK;

Lines 300-305 nsImageLoadingContent::GetImageBlockingS	Link Here

300

NS_IMETHODIMP

325

NS_IMETHODIMP

301

nsImageLoadingContent::AddObserver(imgIDecoderObserver* aObserver)

326

nsImageLoadingContent::AddObserver(imgIDecoderObserver* aObserver)

302

327

328

  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);

329

303

  NS_ENSURE_ARG_POINTER(aObserver);

330

  NS_ENSURE_ARG_POINTER(aObserver);

304

331

305

  if (!mObserverList.mObserver) {

332

  if (!mObserverList.mObserver) {

Lines 326-331 nsImageLoadingContent::AddObserver(imgID	Link Here

326

NS_IMETHODIMP

353

NS_IMETHODIMP

327

nsImageLoadingContent::RemoveObserver(imgIDecoderObserver* aObserver)

354

nsImageLoadingContent::RemoveObserver(imgIDecoderObserver* aObserver)

328

355

356

  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);

357

329

  NS_ENSURE_ARG_POINTER(aObserver);

358

  NS_ENSURE_ARG_POINTER(aObserver);

330

359

331

  if (mObserverList.mObserver == aObserver) {

360

  if (mObserverList.mObserver == aObserver) {

Lines 383-388 NS_IMETHODIMP	Link Here

383

nsImageLoadingContent::GetRequestType(imgIRequest* aRequest,

412

nsImageLoadingContent::GetRequestType(imgIRequest* aRequest,

384

                                      PRInt32* aRequestType)

413

                                      PRInt32* aRequestType)

385

414

415

  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);

416

386

  NS_PRECONDITION(aRequestType, "Null out param");

417

  NS_PRECONDITION(aRequestType, "Null out param");

387

418

388

  if (aRequest == mCurrentRequest) {

419

  if (aRequest == mCurrentRequest) {

Lines 419-424 NS_IMETHODIMP	Link Here

419

nsImageLoadingContent::LoadImageWithChannel(nsIChannel* aChannel,

450

nsImageLoadingContent::LoadImageWithChannel(nsIChannel* aChannel,

420

                                            nsIStreamListener** aListener)

451

                                            nsIStreamListener** aListener)

421

452

453

  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);

454

422

  NS_PRECONDITION(aListener, "null out param");

455

  NS_PRECONDITION(aListener, "null out param");

423

456

424

  NS_ENSURE_ARG_POINTER(aChannel);

457

  NS_ENSURE_ARG_POINTER(aChannel);

Lines 456-461 nsImageLoadingContent::LoadImageWithChan	Link Here

456

489

457

NS_IMETHODIMP nsImageLoadingContent::ForceReload()

490

NS_IMETHODIMP nsImageLoadingContent::ForceReload()

458

491

492

  NS_ENSURE_TRUE(nsContentUtils::IsCallerChrome() || mStartingLoad, NS_ERROR_NOT_AVAILABLE);

493

459

  nsCOMPtr<nsIURI> currentURI;

494

  nsCOMPtr<nsIURI> currentURI;

460

  GetCurrentURI(getter_AddRefs(currentURI));

495

  GetCurrentURI(getter_AddRefs(currentURI));

461

  if (!currentURI) {

496

  if (!currentURI) {

-      Line
+  Link Here
-      Line 0
+  Link Here
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+"use strict";
+var f2;
+function newIframe()
+{
+  var f = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+  f.setAttributeNS(null, "src", "631421.png");
+  document.body.appendChild(f);
+  return f;
+}
+function b1()
+{
+  void newIframe();
+  f2 = newIframe();
+  setTimeout(b2, 0);
+}
+function b2()
+{
+  document.body.removeChild(f2);
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body onload="b1();"></body>
+</html>

(-)a/content/html/document/crashtests/crashtests.list (+1 lines)

Line	Link Here

Lines 10-12 load 468562-2.html	Link Here

load 494225.html

load 494225.html

load 495543.svg

load 495543.svg

load 564461.xhtml

load 564461.xhtml

load 631421.html

(-)a/content/html/document/src/nsImageDocument.cpp (+26 lines)

Line	Link Here

Lines 72-77	Link Here

#include "nsIDocShell.h"

#include "nsIDocShell.h"

#include "nsIContentViewer.h"

#include "nsIContentViewer.h"

#include "nsIMarkupDocumentViewer.h"

#include "nsIMarkupDocumentViewer.h"

#include "nsIJSContextStack.h"

#define AUTOMATIC_IMAGE_RESIZING_PREF "browser.enable_automatic_image_resizing"

#define AUTOMATIC_IMAGE_RESIZING_PREF "browser.enable_automatic_image_resizing"

Lines 351-357 nsImageDocument::Destroy()	Link Here

351

    if (mObservingImageLoader) {

352

    if (mObservingImageLoader) {

352

      nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(mImageContent);

353

      nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(mImageContent);

353

      if (imageLoader) {

354

      if (imageLoader) {

355

        // Push a null JSContext on the stack so that code that

356

        // nsImageLoadingContent doesn't think it's being called by JS.  See

357

        // Bug 631241

358

359

        nsIThreadJSContextStack* stack = nsContentUtils::ThreadJSContextStack();

360

        if (stack) {

361

          stack->Push(nsnull);

362

363

354

        imageLoader->RemoveObserver(this);

364

        imageLoader->RemoveObserver(this);

365

366

        if (stack) {

367

          stack->Pop(nsnull);

368

355

369

356

370

357

371

Lines 644-649 nsImageDocument::CreateSyntheticDocument	Link Here

644

  nsCAutoString src;

658

  nsCAutoString src;

645

  mDocumentURI->GetSpec(src);

659

  mDocumentURI->GetSpec(src);

646

660

661

  // Push a null JSContext on the stack so that code that runs within

662

  // the below code doesn't think it's being called by JS. See bug

663

  // 604262.

664

  nsIThreadJSContextStack* stack = nsContentUtils::ThreadJSContextStack();

665

  if (stack) {

666

    stack->Push(nsnull);

667

668

647

  NS_ConvertUTF8toUTF16 srcString(src);

669

  NS_ConvertUTF8toUTF16 srcString(src);

648

  // Make sure not to start the image load from here...

670

  // Make sure not to start the image load from here...

649

  imageLoader->SetLoadingEnabled(PR_FALSE);

671

  imageLoader->SetLoadingEnabled(PR_FALSE);

Lines 653-658 nsImageDocument::CreateSyntheticDocument	Link Here

653

  body->AppendChildTo(mImageContent, PR_FALSE);

675

  body->AppendChildTo(mImageContent, PR_FALSE);

654

  imageLoader->SetLoadingEnabled(PR_TRUE);

676

  imageLoader->SetLoadingEnabled(PR_TRUE);

655

677

678

  if (stack) {

679

    stack->Pop(nsnull);

680

681

656

  return NS_OK;

682

  return NS_OK;

657

683

658

684

(-)a/layout/generic/nsImageFrame.cpp (-1 / +30 lines)

Line	Link Here

Lines 103-108	Link Here

103

#include "nsLayoutErrors.h"

103

#include "nsLayoutErrors.h"

104

#include "nsBidiUtils.h"

104

#include "nsBidiUtils.h"

105

#include "nsBidiPresUtils.h"

105

#include "nsBidiPresUtils.h"

106

#include "nsIJSContextStack.h"

106

107

#ifdef DEBUG

108

#ifdef DEBUG

108

#undef NOISY_IMAGE_LOADING

109

#undef NOISY_IMAGE_LOADING

Lines 239-245 nsImageFrame::Destroy()	Link Here

239

  if (mListener) {

240

  if (mListener) {

240

    nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(mContent);

241

    nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(mContent);

241

    if (imageLoader) {

242

    if (imageLoader) {

243

      // Push a null JSContext on the stack so that code that runs

244

      // within the below code doesn't think it's being called by

245

      // JS. See bug 604262.

246

      nsIThreadJSContextStack* stack = nsContentUtils::ThreadJSContextStack();

247

      if (stack) {

248

        stack->Push(nsnull);

249

250

242

      imageLoader->RemoveObserver(mListener);

251

      imageLoader->RemoveObserver(mListener);

252

253

      if (stack) {

254

        stack->Pop(nsnull);

255

256

243

257

244

258

245

    reinterpret_cast<nsImageListener*>(mListener.get())->SetFrame(nsnull);

259

    reinterpret_cast<nsImageListener*>(mListener.get())->SetFrame(nsnull);

Lines 265-271 nsImageFrame::Init(nsIContent* aCon	Link Here

265

279

266

  nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(aContent);

280

  nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(aContent);

267

  NS_ENSURE_TRUE(imageLoader, NS_ERROR_UNEXPECTED);

281

  NS_ENSURE_TRUE(imageLoader, NS_ERROR_UNEXPECTED);

268

  imageLoader->AddObserver(mListener);

282

283

284

    // Push a null JSContext on the stack so that code that runs

285

    // within the below code doesn't think it's being called by

286

    // JS. See bug 604262.

287

    nsIThreadJSContextStack* stack = nsContentUtils::ThreadJSContextStack();

288

    if (stack) {

289

      stack->Push(nsnull);

290

291

292

    imageLoader->AddObserver(mListener);

293

294

    if (stack) {

295

      stack->Pop(nsnull);

296

297

269

298

270

  nsPresContext *aPresContext = PresContext();

299

  nsPresContext *aPresContext = PresContext();

271

300

(-)a/layout/svg/base/src/nsSVGImageFrame.cpp (+26 lines)

Line	Link Here

Lines 48-53	Link Here

#include "gfxContext.h"

#include "gfxContext.h"

#include "nsIInterfaceRequestorUtils.h"

#include "nsIInterfaceRequestorUtils.h"

#include "nsIImage.h"

#include "nsIImage.h"

#include "nsIJSContextStack.h"

class nsSVGImageFrame;

class nsSVGImageFrame;

Lines 144-150 nsSVGImageFrame::~nsSVGImageFrame()	Link Here

144

  if (mListener) {

145

  if (mListener) {

145

    nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(mContent);

146

    nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(mContent);

146

    if (imageLoader) {

147

    if (imageLoader) {

148

      // Push a null JSContext on the stack so that code that runs

149

      // within the below code doesn't think it's being called by

150

      // JS. See bug 604262.

151

      nsIThreadJSContextStack* stack = nsContentUtils::ThreadJSContextStack();

152

      if (stack) {

153

        stack->Push(nsnull);

154

155

147

      imageLoader->RemoveObserver(mListener);

156

      imageLoader->RemoveObserver(mListener);

157

158

      if (stack) {

159

        stack->Pop(nsnull);

160

148

161

149

    reinterpret_cast<nsSVGImageListener*>(mListener.get())->SetFrame(nsnull);

162

    reinterpret_cast<nsSVGImageListener*>(mListener.get())->SetFrame(nsnull);

150

163

Lines 163-170 nsSVGImageFrame::Init(nsIContent* aConte	Link Here

163

  if (!mListener) return NS_ERROR_OUT_OF_MEMORY;

176

  if (!mListener) return NS_ERROR_OUT_OF_MEMORY;

164

  nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(mContent);

177

  nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(mContent);

165

  NS_ENSURE_TRUE(imageLoader, NS_ERROR_UNEXPECTED);

178

  NS_ENSURE_TRUE(imageLoader, NS_ERROR_UNEXPECTED);

179

180

  // Push a null JSContext on the stack so that code that runs within

181

  // the below code doesn't think it's being called by JS. See bug

182

  // 604262.

183

  nsIThreadJSContextStack* stack = nsContentUtils::ThreadJSContextStack();

184

  if (stack) {

185

    stack->Push(nsnull);

186

187

166

  imageLoader->AddObserver(mListener);

188

  imageLoader->AddObserver(mListener);

167

189

190

  if (stack) {

191

    stack->Pop(nsnull);

192

193

168

  return NS_OK;

194

  return NS_OK;

169

195

170

196

Return to bug 604262