Bug 1553772 - Bug 1549812 - Don't run arbitrary script from AccessibleCaretManager callbacks. r=TYLin
☠☠ backed out by 781c2bb366d3 ☠ ☠
authorEmilio Cobos Álvarez <emilio@crisal.io>
Thu, 23 May 2019 09:45:47 +0000
changeset 475172 58d40da713559f200d7ea651f2df0c434acee108
parent 475171 32d724d2312caa420601b9cb7e3ef4bf1769b14e
child 475173 7286e18fbc1775558b8653bb63576a47b31a5f3e
push id36057
push useraciure@mozilla.com
push dateThu, 23 May 2019 21:52:03 +0000
treeherdermozilla-central@d551d37b9ad0 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersTYLin
bugs1553772, 1549812
milestone69.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1553772 - Bug 1549812 - Don't run arbitrary script from AccessibleCaretManager callbacks. r=TYLin Instead, post the event for the next turn of the event loop. In this case, what killed the frame is ActionBarHandler.jsm via Selection.toString(). Depends on D31088 Differential Revision: https://phabricator.services.mozilla.com/D31089
layout/base/AccessibleCaretManager.cpp
--- a/layout/base/AccessibleCaretManager.cpp
+++ b/layout/base/AccessibleCaretManager.cpp
@@ -1349,12 +1349,12 @@ void AccessibleCaretManager::DispatchCar
 
   event->SetTrusted(true);
   event->WidgetEventPtr()->mFlags.mOnlyChromeDispatch = true;
 
   AC_LOG("%s: reason %" PRIu32 ", collapsed %d, caretVisible %" PRIu32,
          __FUNCTION__, static_cast<uint32_t>(init.mReason), init.mCollapsed,
          static_cast<uint32_t>(init.mCaretVisible));
 
-  (new AsyncEventDispatcher(doc, event))->RunDOMEventWhenSafe();
+  (new AsyncEventDispatcher(doc, event))->PostDOMEvent();
 }
 
 }  // namespace mozilla