Bug 640652 - When unsetting an attribute on a XUL element, don't let the script blocker to be removed when the document nested update count is 0, since that can trigger XBL bindings, which may run scripts to do things which would lead into crashes; r=sicking a=sayrer

--HG--
extra : rebase_source : e79c187d59225cbc432db5b4b1629d78075477b6
This commit is contained in:
Ehsan Akhgari 2011-03-11 01:04:44 -05:00
parent bb2cc6d8a7
commit 47b89f43e8

View File

@ -1341,7 +1341,8 @@ nsXULElement::UnsetAttr(PRInt32 aNameSpaceID, nsIAtom* aName, PRBool aNotify)
NS_ENSURE_SUCCESS(rv, rv);
}
nsAutoRemovableScriptBlocker scriptBlocker;
nsIDocument* doc = GetCurrentDoc();
mozAutoDocUpdate updateBatch(doc, UPDATE_CONTENT_MODEL, aNotify);
PRBool isId = PR_FALSE;
if (aName == nsGkAtoms::id && aNameSpaceID == kNameSpaceID_None) {
@ -1361,9 +1362,6 @@ nsXULElement::UnsetAttr(PRInt32 aNameSpaceID, nsIAtom* aName, PRBool aNotify)
nsAutoString oldValue;
GetAttr(aNameSpaceID, aName, oldValue);
nsIDocument* doc = GetCurrentDoc();
mozAutoDocUpdate updateBatch(doc, UPDATE_CONTENT_MODEL, aNotify);
// When notifying, make sure to keep track of states whose value
// depends solely on the value of an attribute.
nsEventStates stateMask;