Fix for bug 723465 (Make finalize for DOM list bindings use XPConnect).

--HG--
extra : rebase_source : e4df7d98765aaa2c600044d69f8714568f1d6109
This commit is contained in:
Peter Van der Beken 2012-04-27 10:15:40 +02:00
parent 1780bb4050
commit 5b0b0cd364
4 changed files with 35 additions and 1 deletions

View File

@ -0,0 +1,19 @@
<html>
<head>
<script>
function boom()
{
var f = document.getElementById("f");
var fd = f.contentDocument;
fd.querySelectorAll("*");
fd.documentElement.innerHTML = "3";
document.body.removeChild(f);
}
</script>
</head>
<body onload="boom();"><iframe id="f" src="data:text/html,<html><head onfocus=2>"></iframe></body>
</html>

View File

@ -35,3 +35,4 @@ load 616930-1.html
load 639737-1.html
load 648206-1.html
load 705875.html
load 723465.html

View File

@ -1254,7 +1254,13 @@ ListBase<LC>::finalize(JSFreeOp *fop, JSObject *proxy)
if (cache) {
cache->ClearWrapper();
}
NS_RELEASE(list);
XPCJSRuntime *rt = nsXPConnect::GetRuntimeInstance();
if (rt) {
rt->DeferredRelease(nativeToSupports(list));
}
else {
NS_RELEASE(list);
}
}

View File

@ -125,6 +125,10 @@ public:
*found = false;
return true;
}
static nsISupports* nativeToSupports(nsISupports* aNative)
{
return aNative;
}
};
template<class ListType, class IndexOps, class NameOps=NoOps>
@ -249,6 +253,10 @@ public:
static bool nativeGet(JSContext *cx, JSObject *proxy, JSObject *proto, jsid id, bool *found,
JS::Value *vp);
static ListType *getNative(JSObject *proxy);
static nsISupports* nativeToSupports(ListType* aNative)
{
return Base::nativeToSupports(aNative);
}
};
struct nsISupportsResult