wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-09 17:31:47 +09:00
Code Issues Projects Releases Packages Wiki Activity

Update identifier map entries and notify if they get removed.

Browse source 
This can happen through DestroyElementMaps()
Based on work by Markus Stange and Edgar Chen.
This commit is contained in:
wolfbeast 2019-12-06 14:07:01 +01:00 • committed by Roy Tam
commit 39cc10dde8
4 changed files with 81 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

35
dom/base/nsDocument.cpp
View file

@ -395,6 +395,21 @@ nsIdentifierMapEntry::FireChangeCallbacks(Element* aOldElement,
} }
} }
void
nsIdentifierMapEntry::ClearAndNotify()
{
Element* currentElement = mIdContentList.SafeElementAt(0);
mIdContentList.Clear();
if (currentElement) {
FireChangeCallbacks(currentElement, nullptr);
}
mNameContentList = nullptr;
if (mImageElement) {
SetImageElement(nullptr);
}
mChangeCallbacks = nullptr;
}
namespace { namespace {
struct PositionComparator struct PositionComparator
@ -1422,12 +1437,12 @@ nsDocument::~nsDocument()
delete mSubDocuments; delete mSubDocuments;
mSubDocuments = nullptr; mSubDocuments = nullptr;
nsAutoScriptBlocker scriptBlocker;
// Destroy link map now so we don't waste time removing // Destroy link map now so we don't waste time removing
// links one by one // links one by one
DestroyElementMaps(); DestroyElementMaps();
nsAutoScriptBlocker scriptBlocker;
for (uint32_t indx = mChildren.ChildCount(); indx-- != 0; ) { for (uint32_t indx = mChildren.ChildCount(); indx-- != 0; ) {
mChildren.ChildAt(indx)->UnbindFromTree(); mChildren.ChildAt(indx)->UnbindFromTree();
mChildren.RemoveChildAt(indx); mChildren.RemoveChildAt(indx);
@ -1972,15 +1987,16 @@ nsDocument::ResetToURI(nsIURI *aURI, nsILoadGroup *aLoadGroup,
delete mSubDocuments; delete mSubDocuments;
mSubDocuments = nullptr; mSubDocuments = nullptr;
// Destroy link map now so we don't waste time removing
// links one by one
DestroyElementMaps();
bool oldVal = mInUnlinkOrDeletion; bool oldVal = mInUnlinkOrDeletion;
mInUnlinkOrDeletion = true; mInUnlinkOrDeletion = true;
uint32_t count = mChildren.ChildCount(); uint32_t count = mChildren.ChildCount();
{ // Scope for update { // Scope for update
MOZ_AUTO_DOC_UPDATE(this, UPDATE_CONTENT_MODEL, true); MOZ_AUTO_DOC_UPDATE(this, UPDATE_CONTENT_MODEL, true);
// Destroy link map now so we don't waste time removing
// links one by one
DestroyElementMaps();
for (int32_t i = int32_t(count) - 1; i >= 0; i--) { for (int32_t i = int32_t(count) - 1; i >= 0; i--) {
nsCOMPtr<nsIContent> content = mChildren.ChildAt(i); nsCOMPtr<nsIContent> content = mChildren.ChildAt(i);
@ -8955,7 +8971,14 @@ nsDocument::DestroyElementMaps()
mStyledLinksCleared = true; mStyledLinksCleared = true;
#endif #endif
mStyledLinks.Clear(); mStyledLinks.Clear();
// Notify ID change listeners before clearing the identifier map.
for (auto iter = mIdentifierMap.Iter(); !iter.Done(); iter.Next()) {
iter.Get()->ClearAndNotify();
}
mIdentifierMap.Clear(); mIdentifierMap.Clear();
++mExpandoAndGeneration.generation; ++mExpandoAndGeneration.generation;
} }

5
dom/base/nsDocument.h
View file

@ -216,6 +216,11 @@ public:
void RemoveContentChangeCallback(nsIDocument::IDTargetObserver aCallback, void RemoveContentChangeCallback(nsIDocument::IDTargetObserver aCallback,
void* aData, bool aForImage); void* aData, bool aForImage);
/**
* Remove all elements and notify change listeners.
*/
void ClearAndNotify();
void Traverse(nsCycleCollectionTraversalCallback* aCallback); void Traverse(nsCycleCollectionTraversalCallback* aCallback);
struct ChangeCallback { struct ChangeCallback {

46
dom/canvas/test/reftest/filters/liveness-document-open.html Normal file
View file

@ -0,0 +1,46 @@
<!DOCTYPE html>
<html lang="en">
<title>canvas filters: remove referenced filter element through document.open()</title>
<body onload="loaded()">
<canvas id="canvas" width="10" height="10"></canvas>
<svg height="0">
<filter id="filter">
<feFlood flood-color="red"/>
</filter>
</svg>
<script>
function loaded() {
var ctx = document.getElementById('canvas').getContext('2d');
ctx.filter = 'url(#filter)';
ctx.fillRect(0, 0, 10, 10); // do a draw first to work around bug 1287316
document.open();
// The document.open() call removed #filter from the document. So the filter
// reference should now be invalid, and the rect should be drawn without a
// filter applied, resulting in black.
ctx.fillRect(0, 0, 10, 10);
try {
var data = ctx.getImageData(0, 0, 1, 1).data;
if (data[0] == 0 && data[1] == 0 && data[2] == 0 && data[3] == 255) {
// Successfully painted black.
document.write('PASS');
} else {
// Painted something else, like red.
document.write('FAIL');
}
} catch (e) {
document.write('getImageData failed');
}
document.close();
}
</script>

1
dom/canvas/test/reftest/filters/reftest.list
View file

@ -6,6 +6,7 @@ default-preferences pref(canvas.filters.enabled,true)
fuzzy-if(azureSkia,1,1500) == global-alpha.html global-alpha-ref.html fuzzy-if(azureSkia,1,1500) == global-alpha.html global-alpha-ref.html
== global-composite-operation.html global-composite-operation-ref.html == global-composite-operation.html global-composite-operation-ref.html
== liveness.html ref.html == liveness.html ref.html
== liveness-document-open.html data:text/html,PASS
== multiple-drop-shadows.html shadow-ref.html == multiple-drop-shadows.html shadow-ref.html
== shadow.html shadow-ref.html == shadow.html shadow-ref.html
== subregion-fill-paint.html subregion-ref.html == subregion-fill-paint.html subregion-ref.html