Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-09 03:15:11 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Backed out changeset 54ee322b50cf (bug 1251361) for apparently causing a bunch of OSX m(bc) leaks

Browse Source 
MozReview-Commit-ID: 8v0LiT3sA15

--HG--
extra : rebase_source : 9cdefc51f45a40aed71289958f89883faa757e43
This commit is contained in:
Wes Kocher 2016-04-04 12:32:42 -07:00
parent c6db271911
commit 953cf80ae2
8 changed files with 18 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
dom/base/FragmentOrElement.cpp
View File

@ -1186,6 +1186,10 @@ FragmentOrElement::DestroyContent()
nsBindingManager::eRunDtor);
document->ClearBoxObjectFor(this);
// XXX We really should let cycle collection do this, but that currently still
// leaks (see https://bugzilla.mozilla.org/show_bug.cgi?id=406684).
ReleaseWrapper(this);
uint32_t i, count = mAttrsAndChildren.ChildCount();
for (i = 0; i < count; ++i) {
// The child can remove itself from the parent in BindToTree.

33
dom/base/crashtests/1251361.html
View File

@ -1,33 +0,0 @@
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<script>
var frameRoot;
function boom()
{
var frameWin = f.contentWindow;
frameRoot = frameWin.document.documentElement;
frameWin.location.replace("data:text/html;charset=UTF-8,<body onload='parent.g();'>2");
}
function g()
{
setTimeout(h, 0);
}
function h()
{
var newDoc = document.implementation.createDocument('', '', null);
newDoc.adoptNode(frameRoot);
}
</script>
<body onload="boom();">
<iframe id="f" src="data:text/html;charset=UTF-8,<marquee>1"></iframe>
</body>
</html>

1
dom/base/crashtests/crashtests.list
View File

@ -205,4 +205,3 @@ HTTP(..) load xhr_abortinprogress.html
load xhr_empty_datauri.html
load xhr_html_nullresponse.html
load 1230422.html
load 1251361.html

4
dom/base/nsDocument.cpp
View File

@ -8930,6 +8930,10 @@ nsDocument::Destroy()
mExternalResourceMap.Shutdown();
mRegistry = nullptr;
// XXX We really should let cycle collection do this, but that currently still
// leaks (see https://bugzilla.mozilla.org/show_bug.cgi?id=406684).
ReleaseWrapper(static_cast<nsINode*>(this));
}
void

8
dom/base/nsGenericDOMDataNode.cpp
View File

@ -796,6 +796,14 @@ nsGenericDOMDataNode::SaveSubtreeState()
{
}
void
nsGenericDOMDataNode::DestroyContent()
{
// XXX We really should let cycle collection do this, but that currently still
// leaks (see https://bugzilla.mozilla.org/show_bug.cgi?id=406684).
ReleaseWrapper(this);
}
#ifdef DEBUG
void
nsGenericDOMDataNode::List(FILE* out, int32_t aIndent) const

1
dom/base/nsGenericDOMDataNode.h
View File

@ -141,6 +141,7 @@ public:
MOZ_WARN_UNUSED_RESULT
virtual bool AppendTextTo(nsAString& aResult,
const mozilla::fallible_t&) override;
virtual void DestroyContent() override;
virtual void SaveSubtreeState() override;
#ifdef DEBUG

4
dom/base/nsIContent.h
View File

@ -865,9 +865,7 @@ public:
* Destroy this node and its children. Ideally this shouldn't be needed
* but for now we need to do it to break cycles.
*/
virtual void DestroyContent()
{
}
virtual void DestroyContent() = 0;
/**
* Saves the form state of this node and its children.

2
widget/tests/test_bug673301.xul
View File

@ -33,8 +33,6 @@ transferable.setTransferData("text/unicode", document, 4);
clipboard.setData(transferable, null, Components.interfaces.nsIClipboard.kGlobalClipboard);
transferable.setTransferData("text/unicode", null, 0);
SimpleTest.ok(true, "Didn't crash setting non-text data for text/unicode type");
</script>
</window>