Bug 621618 patch 4: Make conditions in Element::RemoveFromIdTable match those in AddToIdTable, to avoid asymmetric calls to the document's functions. r=bzbarsky
authorL. David Baron <dbaron@dbaron.org>
Tue, 04 Mar 2014 20:13:20 -0800
changeset 190146 50462316925c11b17422d227183075a64942d0e4
parent 190145 90990d488dccf970bdffd0b50953f0a177322099
child 190147 1a34a6a07d711c3722146962871642887765d81b
push id474
push userasasaki@mozilla.com
push dateMon, 02 Jun 2014 21:01:02 +0000
treeherdermozilla-release@967f4cf1b31c [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbzbarsky
bugs621618
milestone30.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 621618 patch 4: Make conditions in Element::RemoveFromIdTable match those in AddToIdTable, to avoid asymmetric calls to the document's functions. r=bzbarsky
content/base/src/Element.cpp
dom/plugins/test/mochitest/test_bug813906.html
--- a/content/base/src/Element.cpp
+++ b/content/base/src/Element.cpp
@@ -731,17 +731,17 @@ Element::RemoveFromIdTable(nsIAtom* aId)
     ShadowRoot* containingShadow = GetContainingShadow();
     // Check for containingShadow because it may have
     // been deleted during unlinking.
     if (containingShadow) {
       containingShadow->RemoveFromIdTable(this, aId);
     }
   } else {
     nsIDocument* doc = GetCurrentDoc();
-    if (doc) {
+    if (doc && (!IsInAnonymousSubtree() || doc->IsXUL())) {
       // id can be null during mutation events evilness. Also, XUL elements
       // loose their proto attributes during cc-unlink, so this can happen
       // during cc-unlink too.
       if (aId) {
         doc->RemoveFromIdTable(this, aId);
       }
     }
   }
--- a/dom/plugins/test/mochitest/test_bug813906.html
+++ b/dom/plugins/test/mochitest/test_bug813906.html
@@ -16,33 +16,26 @@ function f() {
   document.getElementsByTagName("base")[0].href = "http://www.safe.com/";
 }
 </script>
 
 <script type="application/javascript">
 SimpleTest.waitForExplicitFinish();
 setTestPluginEnabledState(SpecialPowers.Ci.nsIPluginTag.STATE_ENABLED);
 
-// When the document is torn down or <svg> is removed, we hit bug 621618
-SimpleTest.expectAssertions(1);
-
 var frameLoadCount = 0;
 function frameLoaded() {
   frameLoadCount++;
   if (frameLoadCount == 1) {
     document.getElementsByTagName("object")[0].type = "application/x-test";
     document.getElementsByTagName("use")[0].setAttributeNS("http://www.w3.org/1999/xlink", "href", location.href + "#a");
   } else if (frameLoadCount == 2) {
     isnot(SpecialPowers.wrap(window.frame1).location.href.indexOf('chrome://'),
           0, 'plugin shouldnt be able to cause navigation to chrome URLs');
-
-    // Make sure we trigger bug 621618 before the test finishes so the assertion
-    // is attributed to this test.
-    document.body.removeChild(document.querySelector("svg"));
-    SimpleTest.executeSoon(function() { SimpleTest.finish(); });
+    SimpleTest.finish();
   }
 }
 </script>
 
 <svg>
   <symbol id="a">
     <foreignObject>
       <object bugmode="813906" frame="frame1"></object>