Bug 637214 - Block scripts when the document's ID table is being modified; r=bzbarsky a=hardblocker

This commit is contained in:
Ehsan Akhgari 2011-03-01 11:19:44 -08:00
parent dcae2bd7ad
commit 1d51d64eae

View File

@ -2622,6 +2622,10 @@ nsDocument::RemoveFromNameTable(Element *aElement, nsIAtom* aName)
void
nsDocument::AddToIdTable(Element *aElement, nsIAtom* aId)
{
// Make sure that id listeners are not notified synchronously while we're
// processing the addition on the hashtable.
nsAutoScriptBlocker scriptBlocker;
nsIdentifierMapEntry *entry =
mIdentifierMap.PutEntry(nsDependentAtomString(aId));
@ -2645,6 +2649,10 @@ nsDocument::RemoveFromIdTable(Element *aElement, nsIAtom* aId)
if (!entry) // Can be null for XML elements with changing ids.
return;
// Make sure that id listeners are not notified synchronously while we're
// processing the removal on the hashtable.
nsAutoScriptBlocker scriptBlocker;
entry->RemoveIdElement(aElement);
if (entry->IsEmpty()) {
mIdentifierMap.RawRemoveEntry(entry);
@ -4103,6 +4111,10 @@ nsDocument::MozSetImageElement(const nsAString& aImageElementId,
if (aImageElementId.IsEmpty())
return NS_OK;
// Make sure that id listeners are not notified synchronously while we're
// processing the addition on the hashtable.
nsAutoScriptBlocker scriptBlocker;
nsCOMPtr<nsIContent> content = do_QueryInterface(aImageElement);
nsIdentifierMapEntry *entry = mIdentifierMap.PutEntry(aImageElementId);
if (entry) {
@ -4120,6 +4132,10 @@ nsDocument::LookupImageElement(const nsAString& aId)
if (aId.IsEmpty())
return nsnull;
// Make sure that id listeners are not notified synchronously while we're
// processing the addition on the hashtable.
nsAutoScriptBlocker scriptBlocker;
nsIdentifierMapEntry *entry = mIdentifierMap.PutEntry(aId);
return entry ? entry->GetImageIdElement() : nsnull;
}