guix-devel/gnu/packages/patches/icecat-CVE-2016-2818-pt4.patch

62 lines
2.1 KiB
Diff
Raw Normal View History

changeset: 312055:b74f1ab939d2
user: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Mon May 16 21:42:24 2016 +0300
summary: Bug 1273202, make sure to not keep objects alive too long because of some useless event dispatching, r=jwatt a=ritu
diff -r 072992bf176d -r b74f1ab939d2 dom/html/HTMLInputElement.cpp
--- a/dom/html/HTMLInputElement.cpp Sun May 15 17:03:06 2016 +0300
+++ b/dom/html/HTMLInputElement.cpp Mon May 16 21:42:24 2016 +0300
@@ -1168,7 +1168,7 @@
mFileList->Disconnect();
}
if (mNumberControlSpinnerIsSpinning) {
- StopNumberControlSpinnerSpin();
+ StopNumberControlSpinnerSpin(eDisallowDispatchingEvents);
}
DestroyImageLoadingContent();
FreeData();
@@ -3721,7 +3721,7 @@
}
void
-HTMLInputElement::StopNumberControlSpinnerSpin()
+HTMLInputElement::StopNumberControlSpinnerSpin(SpinnerStopState aState)
{
if (mNumberControlSpinnerIsSpinning) {
if (nsIPresShell::GetCapturingContent() == this) {
@@ -3732,11 +3732,16 @@
mNumberControlSpinnerIsSpinning = false;
- FireChangeEventIfNeeded();
+ if (aState == eAllowDispatchingEvents) {
+ FireChangeEventIfNeeded();
+ }
nsNumberControlFrame* numberControlFrame =
do_QueryFrame(GetPrimaryFrame());
if (numberControlFrame) {
+ MOZ_ASSERT(aState == eAllowDispatchingEvents,
+ "Shouldn't have primary frame for the element when we're not "
+ "allowed to dispatch events to it anymore.");
numberControlFrame->SpinnerStateChanged();
}
}
diff -r 072992bf176d -r b74f1ab939d2 dom/html/HTMLInputElement.h
--- a/dom/html/HTMLInputElement.h Sun May 15 17:03:06 2016 +0300
+++ b/dom/html/HTMLInputElement.h Mon May 16 21:42:24 2016 +0300
@@ -721,7 +721,12 @@
HTMLInputElement* GetOwnerNumberControl();
void StartNumberControlSpinnerSpin();
- void StopNumberControlSpinnerSpin();
+ enum SpinnerStopState {
+ eAllowDispatchingEvents,
+ eDisallowDispatchingEvents
+ };
+ void StopNumberControlSpinnerSpin(SpinnerStopState aState =
+ eAllowDispatchingEvents);
void StepNumberControlForUserEvent(int32_t aDirection);
/**