Bug 645115 - Flush tree ops in the fragment case when the tree builder yields due to a script. r=bzbarsky.
authorHenri Sivonen <hsivonen@iki.fi>
Wed, 06 Apr 2011 08:42:09 +0300
changeset 67568 0e91598cc3f9c69f951c1d2ed50056488ca5f62e
parent 64674 385684ad7eed256c1710d37e31da6c3e3a92837d
child 67569 80dc22b6c3f66118de8e16ed6e65cc8302a2c10b
push idunknown
push userunknown
push dateunknown
reviewersbzbarsky
bugs645115
milestone2.2a1pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 645115 - Flush tree ops in the fragment case when the tree builder yields due to a script. r=bzbarsky.
parser/html/nsHtml5Parser.cpp
parser/htmlparser/tests/mochitest/Makefile.in
parser/htmlparser/tests/mochitest/test_bug645115.html
--- a/parser/html/nsHtml5Parser.cpp
+++ b/parser/html/nsHtml5Parser.cpp
@@ -528,16 +528,22 @@ nsHtml5Parser::ParseHtml5Fragment(const 
            aSourceBuffer.BeginReading(),
            aSourceBuffer.Length() * sizeof(PRUnichar));
     buffer.setEnd(aSourceBuffer.Length());
     while (buffer.hasMore()) {
       buffer.adjust(lastWasCR);
       lastWasCR = PR_FALSE;
       if (buffer.hasMore()) {
         lastWasCR = mTokenizer->tokenizeBuffer(&buffer);
+        if (mTreeBuilder->HasScript()) {
+          // Flush on each script, because the execution prevention code
+          // can handle at most one script per flush.
+          mTreeBuilder->Flush(); // Move ops to the executor
+          mExecutor->FlushDocumentWrite(); // run the ops
+        }
       }
     }
   }
   mTokenizer->eof();
   mTreeBuilder->StreamEnded();
   mTreeBuilder->Flush();
   mExecutor->FlushDocumentWrite();
   mTokenizer->end();
--- a/parser/htmlparser/tests/mochitest/Makefile.in
+++ b/parser/htmlparser/tests/mochitest/Makefile.in
@@ -79,16 +79,17 @@ include $(topsrcdir)/config/rules.mk
 		file_bug594730-4.html \
 		file_bug594730-5.html \
 		file_bug594730-6.html \
 		file_bug594730-7.html \
 		file_bug594730-8.html \
 		file_bug594730-9.html \
 		test_bug599584.html \
 		iframe_bug599584.html \
+		test_bug645115.html \
 		$(NULL)
 
 # Disabled test due to orange on Linux
 #		test_bug568470.html \
 #		file_bug568470.sjs \
 #		file_bug568470-script.sjs \
 
 # Disable test due to frequent orange on Mac
new file mode 100644
--- /dev/null
+++ b/parser/htmlparser/tests/mochitest/test_bug645115.html
@@ -0,0 +1,32 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=645115
+-->
+<head>
+  <title>Test for Bug 645115</title>
+  <script type="text/javascript" src="/MochiKit/MochiKit.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=645115">Mozilla Bug 645115</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+
+/** Test for Bug 645115 **/
+var div = document.createElement("div");
+div.innerHTML = "\u003Cscript>ok(false, 'innerHTML script ran');\u003C/script>\u003Cscript>";
+document.getElementById("content").appendChild(div);
+
+ok(true, "Keep the test harness happy.");
+
+</script>
+</pre>
+</body>
+</html>
+