Bug 1022869 - Reparent template contents owner document. r=peterv

This commit is contained in:
William Chen 2014-06-25 17:33:24 -07:00
parent fe7a4927a4
commit 16db9ebd74
4 changed files with 66 additions and 1 deletions

View File

@ -1715,7 +1715,7 @@ private:
nsRefPtr<mozilla::dom::ImportManager> mImportManager; nsRefPtr<mozilla::dom::ImportManager> mImportManager;
#ifdef DEBUG #ifdef DEBUG
protected: public:
bool mWillReparent; bool mWillReparent;
#endif #endif
}; };

View File

@ -1576,6 +1576,13 @@ nsHTMLDocument::Open(JSContext* cx,
#ifdef DEBUG #ifdef DEBUG
bool willReparent = mWillReparent; bool willReparent = mWillReparent;
mWillReparent = true; mWillReparent = true;
nsDocument* templateContentsOwner =
static_cast<nsDocument*>(mTemplateContentsOwner.get());
if (templateContentsOwner) {
templateContentsOwner->mWillReparent = true;
}
#endif #endif
// Should this pass true for aForceReuseInnerWindow? // Should this pass true for aForceReuseInnerWindow?
@ -1585,6 +1592,10 @@ nsHTMLDocument::Open(JSContext* cx,
} }
#ifdef DEBUG #ifdef DEBUG
if (templateContentsOwner) {
templateContentsOwner->mWillReparent = willReparent;
}
mWillReparent = willReparent; mWillReparent = willReparent;
#endif #endif
@ -1601,6 +1612,20 @@ nsHTMLDocument::Open(JSContext* cx,
if (rv.Failed()) { if (rv.Failed()) {
return nullptr; return nullptr;
} }
// Also reparent the template contents owner document
// because its global is set to the same as this document.
if (mTemplateContentsOwner) {
JS::Rooted<JSObject*> contentsOwnerWrapper(cx,
mTemplateContentsOwner->GetWrapper());
if (contentsOwnerWrapper) {
rv = mozilla::dom::ReparentWrapper(cx, contentsOwnerWrapper);
if (rv.Failed()) {
return nullptr;
}
}
}
nsIXPConnect *xpc = nsContentUtils::XPConnect(); nsIXPConnect *xpc = nsContentUtils::XPConnect();
rv = xpc->RescueOrphansInScope(cx, oldScope->GetGlobalJSObject()); rv = xpc->RescueOrphansInScope(cx, oldScope->GetGlobalJSObject());
if (rv.Failed()) { if (rv.Failed()) {

View File

@ -164,3 +164,4 @@ skip-if = buildapp == 'b2g' || toolkit == 'android' || e10s #Windows can't chang
[test_toJSON.html] [test_toJSON.html]
[test_window_bar.html] [test_window_bar.html]
skip-if = buildapp == 'b2g' || toolkit == 'android' || e10s skip-if = buildapp == 'b2g' || toolkit == 'android' || e10s
[test_bug1022869.html]

View File

@ -0,0 +1,39 @@
<!DOCTYPE HTML>
<html>
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=1022869
-->
<head>
<meta charset="utf-8">
<title>Test for Bug 1022869</title>
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
<iframe src="data:text/html,<html><body>"></iframe>
<script type="application/javascript">
var f = document.getElementsByTagName("iframe")[0];
SimpleTest.waitForExplicitFinish();
/** Test for Bug 1022869 **/
function startTest() {
var div = f.contentDocument.createElement("div");
div.innerHTML = "<template>x";
is(div.firstChild.content.ownerDocument.parentNode, null, "Should be able to access property on document.");
f.contentDocument.open();
is(div.firstChild.content.ownerDocument.parentNode, null, "Should be able to access property on document after document.open().");
SimpleTest.finish();
}
</script>
</head>
<body onload="startTest()">
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1022869">Mozilla Bug 1022869</a>
<p id="display"></p>
<div id="content" style="display: none">
</div>
<pre id="test">
</pre>
</body>
</html>