Bug 1022869 - Reparent template contents owner document. r=peterv, a=abillings
authorWilliam Chen <wchen@mozilla.com>
Wed, 25 Jun 2014 17:33:24 -0700
changeset 208538 ff12bd072d73938da80b47304f967882c5194eae
parent 208537 6968f4e3e3838e796aacd1a641d1ed5326fbad04
child 208539 0429b5eb93265968a6315498f25e27aa4230ca2d
push id494
push userraliiev@mozilla.com
push dateMon, 25 Aug 2014 18:42:16 +0000
treeherdermozilla-release@a3cc3e46b571 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerspeterv, abillings
bugs1022869
milestone32.0a2
Bug 1022869 - Reparent template contents owner document. r=peterv, a=abillings
content/base/src/nsDocument.h
content/html/document/src/nsHTMLDocument.cpp
dom/tests/mochitest/bugs/mochitest.ini
dom/tests/mochitest/bugs/test_bug1022869.html
--- a/content/base/src/nsDocument.h
+++ b/content/base/src/nsDocument.h
@@ -1698,17 +1698,17 @@ private:
   bool mNeedsReleaseAfterStackRefCntRelease;
 
   CSPErrorQueue mCSPWebConsoleErrorQueue;
 
   nsCOMPtr<nsIDocument> mMasterDocument;
   nsRefPtr<mozilla::dom::ImportManager> mImportManager;
 
 #ifdef DEBUG
-protected:
+public:
   bool mWillReparent;
 #endif
 };
 
 class nsDocumentOnStack
 {
 public:
   nsDocumentOnStack(nsDocument* aDoc) : mDoc(aDoc)
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@@ -1571,41 +1571,66 @@ nsHTMLDocument::Open(JSContext* cx,
   nsPIDOMWindow *window = GetInnerWindow();
   if (window) {
     // Remember the old scope in case the call to SetNewDocument changes it.
     nsCOMPtr<nsIScriptGlobalObject> oldScope(do_QueryReferent(mScopeObject));
 
 #ifdef DEBUG
     bool willReparent = mWillReparent;
     mWillReparent = true;
+
+    nsDocument* templateContentsOwner =
+      static_cast<nsDocument*>(mTemplateContentsOwner.get());
+
+    if (templateContentsOwner) {
+      templateContentsOwner->mWillReparent = true;
+    }
 #endif
 
     // Should this pass true for aForceReuseInnerWindow?
     rv = window->SetNewDocument(this, nullptr, false);
     if (rv.Failed()) {
       return nullptr;
     }
 
 #ifdef DEBUG
+    if (templateContentsOwner) {
+      templateContentsOwner->mWillReparent = willReparent;
+    }
+
     mWillReparent = willReparent;
 #endif
 
     // Now make sure we're not flagged as the initial document anymore, now
     // that we've had stuff done to us.  From now on, if anyone tries to
     // document.open() us, they get a new inner window.
     SetIsInitialDocument(false);
 
     nsCOMPtr<nsIScriptGlobalObject> newScope(do_QueryReferent(mScopeObject));
     JS::Rooted<JSObject*> wrapper(cx, GetWrapper());
     if (oldScope && newScope != oldScope && wrapper) {
       JSAutoCompartment ac(cx, wrapper);
       rv = mozilla::dom::ReparentWrapper(cx, wrapper);
       if (rv.Failed()) {
         return nullptr;
       }
+
+      // Also reparent the template contents owner document
+      // because its global is set to the same as this document.
+      if (mTemplateContentsOwner) {
+        JS::Rooted<JSObject*> contentsOwnerWrapper(cx,
+          mTemplateContentsOwner->GetWrapper());
+        if (contentsOwnerWrapper) {
+          rv = mozilla::dom::ReparentWrapper(cx, contentsOwnerWrapper);
+          if (rv.Failed()) {
+            return nullptr;
+          }
+        }
+      }
+
       nsIXPConnect *xpc = nsContentUtils::XPConnect();
       rv = xpc->RescueOrphansInScope(cx, oldScope->GetGlobalJSObject());
       if (rv.Failed()) {
         return nullptr;
       }
     }
   }
 
--- a/dom/tests/mochitest/bugs/mochitest.ini
+++ b/dom/tests/mochitest/bugs/mochitest.ini
@@ -159,8 +159,9 @@ skip-if = toolkit == 'android' || e10s #
 [test_protochains.html]
 [test_resize_move_windows.html]
 skip-if = buildapp == 'b2g' || toolkit == 'android' || e10s #Windows can't change size and position on Android # b2g(Windows can't change size and position on B2G) b2g-debug(Windows can't change size and position on B2G) b2g-desktop(Windows can't change size and position on B2G)
 [test_sizetocontent_clamp.html]
 skip-if = buildapp == 'b2g' || toolkit == 'android' || e10s #Windows can't change size on Android # b2g(Windows can't change size on B2G) b2g-debug(Windows can't change size on B2G) b2g-desktop(Windows can't change size on B2G)
 [test_toJSON.html]
 [test_window_bar.html]
 skip-if = buildapp == 'b2g' || toolkit == 'android' || e10s
+[test_bug1022869.html]
new file mode 100644
--- /dev/null
+++ b/dom/tests/mochitest/bugs/test_bug1022869.html
@@ -0,0 +1,39 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1022869
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 1022869</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <iframe src="data:text/html,<html><body>"></iframe>
+  <script type="application/javascript">
+
+  var f = document.getElementsByTagName("iframe")[0];
+
+  SimpleTest.waitForExplicitFinish();
+
+  /** Test for Bug 1022869 **/
+  function startTest() {
+    var div = f.contentDocument.createElement("div");
+    div.innerHTML = "<template>x";
+    is(div.firstChild.content.ownerDocument.parentNode, null, "Should be able to access property on document.");
+    f.contentDocument.open();
+    is(div.firstChild.content.ownerDocument.parentNode, null, "Should be able to access property on document after document.open().");
+
+    SimpleTest.finish();
+  }
+
+  </script>
+</head>
+<body onload="startTest()">
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1022869">Mozilla Bug 1022869</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+</div>
+<pre id="test">
+</pre>
+</body>
+</html>