From 5d4c82e0923e63077738ba4b63ab290810537f11 Mon Sep 17 00:00:00 2001 From: wolfbeast Date: Fri, 6 Dec 2019 14:07:01 +0100 Subject: Update identifier map entries and notify if they get removed. This can happen through DestroyElementMaps() Based on work by Markus Stange and Edgar Chen. --- dom/base/nsDocument.cpp | 35 +++++++++++++--- dom/base/nsDocument.h | 5 +++ .../reftest/filters/liveness-document-open.html | 46 ++++++++++++++++++++++ dom/canvas/test/reftest/filters/reftest.list | 1 + 4 files changed, 81 insertions(+), 6 deletions(-) create mode 100644 dom/canvas/test/reftest/filters/liveness-document-open.html diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp index 6b8e11db05..e2be6b6645 100644 --- a/dom/base/nsDocument.cpp +++ b/dom/base/nsDocument.cpp @@ -395,6 +395,21 @@ nsIdentifierMapEntry::FireChangeCallbacks(Element* aOldElement, } } +void +nsIdentifierMapEntry::ClearAndNotify() +{ + Element* currentElement = mIdContentList.SafeElementAt(0); + mIdContentList.Clear(); + if (currentElement) { + FireChangeCallbacks(currentElement, nullptr); + } + mNameContentList = nullptr; + if (mImageElement) { + SetImageElement(nullptr); + } + mChangeCallbacks = nullptr; +} + namespace { struct PositionComparator @@ -1422,12 +1437,12 @@ nsDocument::~nsDocument() delete mSubDocuments; mSubDocuments = nullptr; + nsAutoScriptBlocker scriptBlocker; + // Destroy link map now so we don't waste time removing // links one by one DestroyElementMaps(); - nsAutoScriptBlocker scriptBlocker; - for (uint32_t indx = mChildren.ChildCount(); indx-- != 0; ) { mChildren.ChildAt(indx)->UnbindFromTree(); mChildren.RemoveChildAt(indx); @@ -1972,15 +1987,16 @@ nsDocument::ResetToURI(nsIURI *aURI, nsILoadGroup *aLoadGroup, delete mSubDocuments; mSubDocuments = nullptr; - // Destroy link map now so we don't waste time removing - // links one by one - DestroyElementMaps(); - bool oldVal = mInUnlinkOrDeletion; mInUnlinkOrDeletion = true; uint32_t count = mChildren.ChildCount(); { // Scope for update MOZ_AUTO_DOC_UPDATE(this, UPDATE_CONTENT_MODEL, true); + + // Destroy link map now so we don't waste time removing + // links one by one + DestroyElementMaps(); + for (int32_t i = int32_t(count) - 1; i >= 0; i--) { nsCOMPtr content = mChildren.ChildAt(i); @@ -8955,7 +8971,14 @@ nsDocument::DestroyElementMaps() mStyledLinksCleared = true; #endif mStyledLinks.Clear(); + + // Notify ID change listeners before clearing the identifier map. + for (auto iter = mIdentifierMap.Iter(); !iter.Done(); iter.Next()) { + iter.Get()->ClearAndNotify(); + } + mIdentifierMap.Clear(); + ++mExpandoAndGeneration.generation; } diff --git a/dom/base/nsDocument.h b/dom/base/nsDocument.h index 2b29b98fa5..ac600eb433 100644 --- a/dom/base/nsDocument.h +++ b/dom/base/nsDocument.h @@ -216,6 +216,11 @@ public: void RemoveContentChangeCallback(nsIDocument::IDTargetObserver aCallback, void* aData, bool aForImage); + /** + * Remove all elements and notify change listeners. + */ + void ClearAndNotify(); + void Traverse(nsCycleCollectionTraversalCallback* aCallback); struct ChangeCallback { diff --git a/dom/canvas/test/reftest/filters/liveness-document-open.html b/dom/canvas/test/reftest/filters/liveness-document-open.html new file mode 100644 index 0000000000..b3d76e550a --- /dev/null +++ b/dom/canvas/test/reftest/filters/liveness-document-open.html @@ -0,0 +1,46 @@ + + + +canvas filters: remove referenced filter element through document.open() + + + + + + + + + + + + diff --git a/dom/canvas/test/reftest/filters/reftest.list b/dom/canvas/test/reftest/filters/reftest.list index 9830307159..f5d671e4dc 100644 --- a/dom/canvas/test/reftest/filters/reftest.list +++ b/dom/canvas/test/reftest/filters/reftest.list @@ -6,6 +6,7 @@ default-preferences pref(canvas.filters.enabled,true) fuzzy-if(azureSkia,1,1500) == global-alpha.html global-alpha-ref.html == global-composite-operation.html global-composite-operation-ref.html == liveness.html ref.html +== liveness-document-open.html data:text/html,PASS == multiple-drop-shadows.html shadow-ref.html == shadow.html shadow-ref.html == subregion-fill-paint.html subregion-ref.html -- cgit v1.2.3