Bug 1549812 - Don't run arbitrary script from AccessibleCaretManager callbacks. r=TYLin
☠☠ backed out by c81a6ac1b894 ☠ ☠
authorEmilio Cobos Álvarez <emilio@crisal.io>
Fri, 17 May 2019 03:25:02 +0000
changeset 474340 cbc5c04bd3e4fb6cbfa04dc02f3f1e3cfd6c05a1
parent 474339 ac4a070f110542b267763a0544a6e13912170d8c
child 474341 00afc705d4eef04a1d71cea44953d0ba232a3794
push id113149
push userrgurzau@mozilla.com
push dateFri, 17 May 2019 21:50:06 +0000
treeherdermozilla-inbound@6e4c58629a7c [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersTYLin
bugs1549812
milestone68.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1549812 - Don't run arbitrary script from AccessibleCaretManager callbacks. r=TYLin Instead, post the event for the next turn of the event loop. In this case, what killed the frame is ActionBarHandler.jsm via Selection.toString(). Depends on D31088 Differential Revision: https://phabricator.services.mozilla.com/D31089
layout/base/AccessibleCaretManager.cpp
--- a/layout/base/AccessibleCaretManager.cpp
+++ b/layout/base/AccessibleCaretManager.cpp
@@ -1349,12 +1349,12 @@ void AccessibleCaretManager::DispatchCar
 
   event->SetTrusted(true);
   event->WidgetEventPtr()->mFlags.mOnlyChromeDispatch = true;
 
   AC_LOG("%s: reason %" PRIu32 ", collapsed %d, caretVisible %" PRIu32,
          __FUNCTION__, static_cast<uint32_t>(init.mReason), init.mCollapsed,
          static_cast<uint32_t>(init.mCaretVisible));
 
-  (new AsyncEventDispatcher(doc, event))->RunDOMEventWhenSafe();
+  (new AsyncEventDispatcher(doc, event))->PostDOMEvent();
 }
 
 }  // namespace mozilla