Commit Graph

152 Commits

Author SHA1 Message Date
Jesse Ruderman
b5cbc6c7a9 Bug 607222 - Add crashtest. r=mats 2018-07-01 18:06:49 +02:00
Olli Pettay
36d68d7024 Bug 1441029, give up early on invalid 'is attribute values, r=mrbkap
--HG--
extra : rebase_source : 5e63b39f69e2acafb67fbc8d8dda2fee155db61f
2018-05-30 12:41:20 +03:00
Emilio Cobos Álvarez
dd5f25c2f6 Bug 1465107: Cleanup remaining mochitest / reftest / crashtests stylo expectations. r=xidorn
MozReview-Commit-ID: 1IeURcnoESX
2018-05-30 10:03:50 +02:00
Olli Pettay
41366ba801 bug 1460794, ensure the right document is used for DOMSubtreeModified event, r=hsivonen
--HG--
extra : rebase_source : 1363016f0a6da8ca2f5be4d0a21e1ee0a6376c1c
2018-05-13 00:46:45 +03:00
Dão Gottwald
140aac0617 Bug 1456530 - Stop dispatching the select event on the tabs element. r=mconley
MozReview-Commit-ID: B4Ash6lC64u

--HG--
extra : rebase_source : a40cde1b42c9c6fb0c76e021556e8458176dfc32
2018-05-08 11:48:00 +02:00
Emilio Cobos Álvarez
e6040e95d1 Bug 1459688: Properly traverse the stylesheet list of the shadow root. r=smaug
This is sound because the unlink implementation of the stylesheet drops the
preserved wrapper, and there are no strong references back to any node from the
stylesheet or any of the non-unlinked members.

This almost is the same setup that works for document sheets. We need to account
for a double reference in case the sheet is applicable because Servo keeps
another reference to it in that case, instead of in the StyleSet / PresShell.

Added the testcase as a crashtest, in the hopes that if it regresses leak
reporting on automation will catch it.

MozReview-Commit-ID: Kcc5oaOvP9A
2018-05-07 20:42:20 +02:00
Tyson Smith
0d486d7cd3 Bug 1458016: Crashtest. r=emilio
MozReview-Commit-ID: LQeydd27UjF
2018-05-02 04:21:22 +02:00
Tyson Smith
8e22327e93 Bug 1422883: Crashtest. r=emilio
MozReview-Commit-ID: HaE9RYyMrmZ
2018-05-02 04:19:12 +02:00
Emilio Cobos Álvarez
004145b9a3 Bug 1281745: Don't consider <xbl:children> in a shadow root without any binding active. r=smaug
MozReview-Commit-ID: GSewdIOpKIv
2018-04-13 20:53:11 +02:00
Emilio Cobos Álvarez
9509cd7e32 Bug 1453789: Remove Element.createShadowRoot. r=smaug
MozReview-Commit-ID: Hgxbp1Icgvh
2018-04-13 20:51:55 +02:00
Boris Zbarsky
b3e9f0c75d Bug 1449601. Stop dereferencing a null mIterNode in find code. r=mystor
MozReview-Commit-ID: 2buTShJNqFp
2018-04-09 16:30:31 -04:00
Boris Zbarsky
c6d492b79e Bug 1445670. Make sure to clear out the pending request when our image gets blocked by the data document policy. r=jdm 2018-04-04 14:40:01 -04:00
Jonathan Watt
f6c1f57fe8 Bug 1397795 part 3 - Don't rely on opaque widgets not having overflow. r=mstange
MozReview-Commit-ID: GJNDwQUjfEr
2018-02-19 16:00:32 +00:00
Jonathan Watt
a39f30cb97 Bug 1397795 part 2 - Crashtest for box-shadow. r=mstange
MozReview-Commit-ID: 8zEK1R77znx
2018-02-19 13:14:46 +00:00
Emilio Cobos Álvarez
d5f66d9925 Bug 1446668: Remove setUserData crashtests. r=smaug
Reviewers: smaug

Bug #: 1446668

Differential Revision: https://phabricator.services.mozilla.com/D758

MozReview-Commit-ID: wyAvCCWbrS
2018-03-18 01:53:13 +01:00
Florian Quèze
c714053d73 Bug 1433175 - scripted patch to replace Components.classes[, Components.interfaces.nsI, Components.utils. and Components.results. with Cc, Ci, Cu and Cr, r=Mossop. 2018-02-28 18:51:33 +01:00
Jessica Jong
4bee56a645 Bug 1428685 - Use dom.webcomponents.shadowdom.enabled pref for Shadow DOM. r=smaug
Most of the Shadow DOM related code are behind "dom.webcomponents.enabled" and
this pref is only used by Shadow DOM right now, so we should rename it to
"dom.webcomponents.shadowdom.enabled"

MozReview-Commit-ID: er1c7AsSSW
2018-01-16 17:16:30 +01:00
Emilio Cobos Álvarez
198b044d86 Bug 1428053: Fix ShadowRoot::ContentAppended. r=jessica
MozReview-Commit-ID: iUhaP8VVIO
2018-01-05 11:18:18 +01:00
Christoph Kerschbaumer
4ed18db7cb Bug 1419902 - Add crashtest for nullptr deref of doc within nsGlobalWindowOuter::CloseOuter. r=smaug,ryanvm 2017-12-13 20:27:13 +01:00
Andreea Pavel
fde133ddff Backed out 1 changesets (bug 1419902) for crashtest failures e.g. /build/tests/reftest/tests/gfx/tests/crashtests/1343666.html r=backout a=backout on a CLOSED TREE
Backed out changeset 8a16779be2fb (bug 1419902)
2017-12-19 23:06:40 +02:00
Christoph Kerschbaumer
791887bedd Bug 1419902 - Add crashtest for nullptr deref of doc within nsGlobalWindowOuter::CloseOuter. r=smaug
--HG--
extra : rebase_source : 400d67698e5901d915832b133b95f47765e16af7
2017-12-13 20:27:13 +01:00
Jessica Jong
b519c97d26 Bug 1422931 - Part 1: Fix crash with slot element. r=smaug 2017-12-09 11:24:58 +08:00
Narcis Beleuzu
f0d93dda2c Backed out 2 changesets (bug 1422931) for crashtest failures on dom/base/crashtests/1419799.html r=backout on a CLOSED TREE
Backed out changeset 60d9744e3fc4 (bug 1422931)
Backed out changeset cf554d5d70cc (bug 1422931)
2017-12-08 18:27:56 +02:00
Jessica Jong
491af03c03 Bug 1422931 - Part 1: Fix crash with slot element. r=smaug 2017-12-08 22:17:33 +08:00
Jessica Jong
765510cef9 Bug 1419799 - Fix nsContentUtils::IsInSameAnonymousTree in Shadow DOM. r=smaug
No need to consider multiple shadow roots as it is only supported in Shadow DOM
v0, which is deprecated now.

MozReview-Commit-ID: BKemIBiMx1Q
2017-12-08 15:13:19 +08:00
Honza Bambas
8402a72987 Bug 1385298 - Fix test for bug 504224 to actually do something. r=bkelly 2017-12-04 15:24:00 -05:00
Edgar Chen
64dec8edc1 Bug 1400762 - Make dom.webcomponents.enabled pref doesn't control CustomElements feature; r=smaug
CustomElements feature now is only controlled by dom.webcomponents.customelements.enabled pref.

MozReview-Commit-ID: G6hdIAsSeX7

--HG--
extra : rebase_source : 064349a0319e445e4bcd6bfbdcd69b7085c347b6
2017-11-15 15:41:14 +08:00
Yoshi Huang
89fce65edf Bug 1411473 - Skip image loading from adoption if OwnerDoc is not allowed to. r=bz
In the test file 1411473.html, there are 3 calls to
nsImageLoadingContent::LoadImage

1. Triggered by setting src attribute, and this sets the mCurrentRequest.

2. Triggered by setting crossOrigin attribute, this forcibly reloads the image,
and this sets the mPendingRequest.

3. Triggered by loading the image which is adopted into a new created data
document by
'document.implementation.createDocument('', '', null).adoptNode(img)'

However in the 3rd call, when it calls nsImageLoadingContent::LoadImage, It
will bail out in the aDocument->IsLoadedAsData() part
http://searchfox.org/mozilla-central/rev/5a60492a53667fc61a62af1847d005a210b7a4f6/dom/base/nsImageLoadingContent.cpp#942

And when it calls SetBlockedRequest, at this time we have a non-null
mCurrentRequest and a non-null mPendingRequest, so this triggers the
assertion of mPendingRequest should be null when we got blocked, which
is added in bug 1267075.

Since data document is not the active document,
per https://html.spec.whatwg.org/multipage/images.html#updating-the-image-data,
Step 1, we should skip the image loading in HTMLImageElement.
2017-11-09 19:01:41 +08:00
Edgar Chen
91920b5742 Bug 1413815 - Convert 'observedAttributes' to a sequence<DOMString>; r=bz
MozReview-Commit-ID: 1AYK5RF5GNc

--HG--
extra : rebase_source : ec8bb2091f9163dc11a6cd52c0201f2007bc795f
2017-11-03 10:50:05 +08:00
Jesse Ruderman
8d28e8cb3d Bug 675516 - Add crashtest. r=me 2017-10-25 14:58:33 -04:00
Jesse Ruderman
ec3a155f1b Bug 1281715 - Add crashtest. r=me 2017-10-18 09:43:11 -04:00
Boris Zbarsky
3fc7b4c919 Bug 1324463. Fix crash when xbl:children is stuck into shadow DOM. r=smaug
MozReview-Commit-ID: C602pPbIfih
2017-10-11 22:19:10 -04:00
Sebastian Hengst
bf13779eda Backed out changeset 76fb9cb1078c (bug 1324463) for failing own crashtest in non-stylo builds. r=backout on a CLOSED TREE
--HG--
extra : amend_source : 41a2653de93c450e89a005beb532177cf224eea7
2017-10-12 09:42:53 +02:00
Boris Zbarsky
fb61ca8219 Bug 1324463. Fix crash when xbl:children is stuck into shadow DOM. r=smaug
MozReview-Commit-ID: C602pPbIfih
2017-10-11 22:19:10 -04:00
Jason Orendorff
2db41f075d Bug 1396466 - Remove Xray expando chains from the weakmap when transplanting nodes. r=bz
--HG--
extra : rebase_source : aa90385160666b155cc8dbad63bcfa34d3e50d32
extra : amend_source : 6b9ebda268a6198f5e0143e5449f9d62ef1aed76
2017-10-10 10:42:18 -05:00
Ryan VanderMeulen
a2439271da Bug 1324500 - Add crashtest. r=me
--HG--
extra : rebase_source : 22ebaca44bd9a34c51d417778ffa22f79ceeee79
2017-10-11 11:52:39 -04:00
Sebastian Hengst
5d61e2eec8 merge mozilla-inbound to mozilla-central. r=merge a=merge
MozReview-Commit-ID: JDCYKq7yKwb
2017-10-07 10:45:11 +02:00
Ehsan Akhgari
646c3c8a8a Bug 1405771 - Run the selection listeners after Range mutation observers have finished running to make sure no stale Ranges are observable from the listeners; r=smaug 2017-10-06 15:54:39 -04:00
Cameron McCormack
c970a23771 Bug 1406109 - Return early after selector parsing failure in matches(). r=emilio
MozReview-Commit-ID: 6qXvrQ0eigI

--HG--
extra : rebase_source : 2355ccfef79e657e04bbaddfcaa9da63015076e5
2017-10-06 14:16:13 +08:00
cku
51c6fc95ad Bug 1373750 - Part 2. Add a crash test consists of two mask layers. r=mstange
MozReview-Commit-ID: ECiDHwCqO1B

--HG--
extra : rebase_source : 8fcda747133df7379d6924d7e118025ece5d4223
extra : source : 69c8d44122acb3fefc3297138938d537eefc46f8
2017-09-25 15:35:37 +08:00
Andrew McCreight
f31f7f7cc6 Bug 1403377 - Destroy hash table iterator before modifying hash table. r=smaug
nsDOMAttributeMap::BlastSubtreeToPieces() uses a hash table iterator
to get an arbitrary element from a hash table. This marks the hash
table as being in use. It then modifies the hash table before the
iterator is destroyed, triggering an assertion. The fix is to restrict
the scope of the iterator so that it is destroyed before the hashtable
is modified.

The existing code is safe because the iterator is never used after the
hash table has been modified.

MozReview-Commit-ID: DUjqewvwEe7

--HG--
extra : rebase_source : 698046af75890c8f52ba15331115b9ff119c689a
2017-09-27 14:49:35 -07:00
Ehsan Akhgari
445883e2e9 Bug 1400701 - Don't use text nodes under <bdi> elements to determine the directionality of the ancestors; r=smaug 2017-09-26 14:30:15 -04:00
Ethan Lin
9c5fa8f8b7 Bug 1352453 - Add crashtest for this bug. r=heycam
MozReview-Commit-ID: 97vLPFkTYli

--HG--
extra : rebase_source : aee6981d876242295124338b73ad575b6f2c3826
2017-09-23 15:20:05 +08:00
Andrea Marchesini
2071ba4680 Bug 1397145 - Remove the support for moz-blob type in XHR, r=smaug 2017-09-22 07:18:14 +02:00
Boris Zbarsky
4d16655b25 Bug 1393806 part 3. Change dom::ReparentWrapper to take an ErrorResult. r=peterv
This makes it easier for its consumers to avoid leaving a dangling exception on
the JSContext.

MozReview-Commit-ID: Xep7IkYxSx
2017-09-13 13:34:55 -04:00
Xidorn Quan
b3ff6bb3dc Bug 1324691 followup - Remove the last condition on crashtest of this bug. r=xidorn
MozReview-Commit-ID: 5avaNKTAEsZ

--HG--
extra : rebase_source : f77308e865b37418991317b865bf02d3f448ca1e
2017-09-11 14:27:30 +10:00
Samael Wang
fbc657f448 Bug 1368327 - Do not assert aDocShell in Location, since it's actually possible to be nullptr. r=smaug
MozReview-Commit-ID: ArqkI8TUf8r

--HG--
extra : rebase_source : 9d6850bb6f27293a8e68ecc5c521e4ae769da455
2017-08-28 17:12:47 +08:00
Xidorn Quan
179961b3c9 Bug 1383845 - Enable tests disabled for bug 1383845. r=TYLin
MozReview-Commit-ID: Glao9d9PiUF

--HG--
extra : rebase_source : cfc70fcb350a7ee8e325ba1bda0bcdead62d786e
2017-08-17 10:51:59 +10:00
Henri Sivonen
057b37715a Bug 1385272 - Make plaintext serializer not crash when a <tr> is a child of a <tr>. r=Ehsan
MozReview-Commit-ID: CMNIWYX8R07

--HG--
extra : rebase_source : 0b245f01c4c7aa4b78853534584876a23689826c
2017-08-14 14:24:51 +03:00
Xidorn Quan
8c243b6260 Bug 1383780 - Null-check return value of SVGUseElement::GetContentURLData before returning. r=bz
MozReview-Commit-ID: 19X22AVQ4Gg

--HG--
extra : rebase_source : 2fa532cec7931603540553fc1bf51787f52d7647
2017-08-02 12:07:58 +10:00