Bug 645115 - Flush tree ops in the fragment case when the tree builder yields due to a script. r=bzbarsky.

2011-04-06 08:42:09 +03:00
parent 403f47536e
commit 64798da063
3 changed files with 39 additions and 0 deletions
--- a/parser/html/nsHtml5Parser.cpp
+++ b/parser/html/nsHtml5Parser.cpp
@@ -533,6 +533,12 @@ nsHtml5Parser::ParseHtml5Fragment(const nsAString& aSourceBuffer,
      lastWasCR = PR_FALSE;
      if (buffer.hasMore()) {
        lastWasCR = mTokenizer->tokenizeBuffer(&buffer);
+        if (mTreeBuilder->HasScript()) {
+          // Flush on each script, because the execution prevention code
+          // can handle at most one script per flush.
+          mTreeBuilder->Flush(); // Move ops to the executor
+          mExecutor->FlushDocumentWrite(); // run the ops
+        }
      }
    }
  }