Bug 594774. Detect DOM changes during painting, and abort painting ASAP when that happens. r=dbaron a=blocking

layout/base/FrameLayerBuilder.h

@@ -49,6 +49,7 @@ class nsDisplayListBuilder;
 class nsDisplayList;
 class nsDisplayItem;
 class gfxContext;
+class nsRootPresContext;
 
 namespace mozilla {
 
@@ -97,6 +98,7 @@ public:
 
   FrameLayerBuilder() :
     mRetainingManager(nsnull),
+    mDetectedDOMModification(PR_FALSE),
     mInvalidateAllThebesContent(PR_FALSE),
     mInvalidateAllLayers(PR_FALSE)
   {
@@ -104,6 +106,8 @@ public:
     mThebesLayerItems.Init();
   }
 
+  void Init(nsDisplayListBuilder* aBuilder);
+
   /**
    * Call this to notify that we are about to start a transaction on the
    * retained layer manager aManager.
@@ -411,11 +415,22 @@ protected:
   static PLDHashOperator StoreNewDisplayItemData(DisplayItemDataEntry* aEntry,
                                                  void* aUserArg);
 
+  /**
+   * Returns true if the DOM has been modified since we started painting,
+   * in which case we should bail out and not paint anymore. This should
+   * never happen, but plugins can trigger it in some cases.
+   */
+  PRBool CheckDOMModified();
+
   /**
    * The layer manager belonging to the widget that is being retained
    * across paints.
    */
   LayerManager*                       mRetainingManager;
+  /**
+   * The root prescontext for the display list builder reference frame
+   */
+  nsRootPresContext*                  mRootPresContext;
   /**
    * A map from frames to a list of (display item key, layer) pairs that
    * describes what layers various parts of the frame are assigned to.
@@ -426,6 +441,15 @@ protected:
    * clipping data) to be rendered in the layer.
    */
   nsTHashtable<ThebesLayerItemsEntry> mThebesLayerItems;
+  /**
+   * Saved generation counter so we can detect DOM changes.
+   */
+  PRUint32                            mInitialDOMGeneration;
+  /**
+   * Set to true if we have detected and reported DOM modification during
+   * the current paint.
+   */
+  PRPackedBool                        mDetectedDOMModification;
   /**
    * Indicates that the contents of all ThebesLayers should be rerendered
    * during this paint.