Bug 930250 - Don't tear down XBL binding when element is in document. r=bz
authorWilliam Chen <wchen@mozilla.com>
Fri, 07 Mar 2014 15:48:20 -0800
changeset 190840 f80cd801c0e379d749c795c5bf912954ee574d6c
parent 190839 ac15b6e719bed5ad0c9454a07551c77098410ddb
child 190841 947e70a10659166d942fda62145d903c50f56a2d
push id474
push userasasaki@mozilla.com
push dateMon, 02 Jun 2014 21:01:02 +0000
treeherdermozilla-release@967f4cf1b31c [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbz
bugs930250
milestone30.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 930250 - Don't tear down XBL binding when element is in document. r=bz
content/base/crashtests/930250.html
content/base/crashtests/crashtests.list
content/base/src/Element.cpp
new file mode 100644
--- /dev/null
+++ b/content/base/crashtests/930250.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<body>
+<nobr>
+<h4 contenteditable="true">
+<iframe></iframe>
+<applet></applet>
+<nobr>
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@@ -141,10 +141,11 @@ load 847127.html
 load 845093-1.html
 load 845093-2.html
 load 849727.html
 load 849732.html
 load 849601.html
 skip-if(Android) load 851353-1.html
 load 863950.html
 load 864448.html
+load 930250.html
 load 942979.html
 load 978646.html
--- a/content/base/src/Element.cpp
+++ b/content/base/src/Element.cpp
@@ -1259,17 +1259,27 @@ public:
   RemoveFromBindingManagerRunnable(nsBindingManager* aManager,
                                    Element* aElement,
                                    nsIDocument* aDoc):
     mManager(aManager), mElement(aElement), mDoc(aDoc)
   {}
 
   NS_IMETHOD Run()
   {
-    mManager->RemovedFromDocumentInternal(mElement, mDoc);
+    // It may be the case that the element was removed from the
+    // DOM, causing this runnable to be created, then inserted back
+    // into the document before the this runnable had a chance to
+    // tear down the binding. Only tear down the binding if the element
+    // is still no longer in the DOM. nsXBLService::LoadBinding tears
+    // down the old binding if the element is inserted back into the
+    // DOM and loads a different binding.
+    if (!mElement->IsInDoc()) {
+      mManager->RemovedFromDocumentInternal(mElement, mDoc);
+    }
+
     return NS_OK;
   }
 
 private:
   nsRefPtr<nsBindingManager> mManager;
   nsRefPtr<Element> mElement;
   nsCOMPtr<nsIDocument> mDoc;
 };