Bug 1434273. Make nsGenConImageContent's inheritance match the way it's used. r=mccr8

MozReview-Commit-ID: AYL4iZkMJiH

dom/base/nsContentCreatorFunctions.h

@@ -17,6 +17,7 @@
  */
 
 class nsIContent;
+class nsIDocument;
 class imgRequestProxy;
 class nsGenericHTMLElement;
 
@@ -72,9 +73,11 @@ NS_NewSVGElement(mozilla::dom::Element** aResult,
                  already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo,
                  mozilla::dom::FromParser aFromParser);
 
-nsresult
+namespace mozilla {
-NS_NewGenConImageContent(nsIContent** aResult,
+namespace dom {
-                         already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo,
+already_AddRefed<nsIContent>
-                         imgRequestProxy* aImageRequest);
+CreateGenConImageContent(nsIDocument* aDocument, imgRequestProxy* aImageRequest);
+} // namespace dom
+} // namespace mozilla
 
 #endif // nsContentCreatorFunctions_h__

dom/base/nsGenConImageContent.cpp

@@ -12,25 +12,31 @@
  */
 
 #include "nsContentCreatorFunctions.h"
-#include "nsXMLElement.h"
+#include "nsGenericHTMLElement.h"
+#include "nsGkAtoms.h"
+#include "nsIDocument.h"
 #include "nsImageLoadingContent.h"
 #include "imgIRequest.h"
+#include "nsNodeInfoManager.h"
 #include "mozilla/BasicEvents.h"
 #include "mozilla/EventDispatcher.h"
 #include "mozilla/EventStates.h"
+#include "mozilla/dom/HTMLElementBinding.h"
+#include "mozilla/dom/NameSpaceConstants.h"
 
 using namespace mozilla;
 
-class nsGenConImageContent final : public nsXMLElement,
+class nsGenConImageContent final : public nsGenericHTMLElement,
                                    public nsImageLoadingContent
 {
 public:
-  explicit nsGenConImageContent(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
+  explicit nsGenConImageContent(already_AddRefed<dom::NodeInfo>& aNodeInfo)
-    : nsXMLElement(aNodeInfo)
+    : nsGenericHTMLElement(aNodeInfo)
   {
     // nsImageLoadingContent starts out broken, so we start out
     // suppressed to match it.
     AddStatesSilently(NS_EVENT_STATE_SUPPRESSED);
+    MOZ_ASSERT(IsInNamespace(kNameSpaceID_XHTML), "Someone messed up our nodeinfo");
   }
 
   nsresult Init(imgRequestProxy* aImageRequest)
@@ -54,12 +60,17 @@ public:
       // Don't propagate the events to the parent.
       return NS_OK;
     }
-    return nsXMLElement::GetEventTargetParent(aVisitor);
+    return nsGenericHTMLElement::GetEventTargetParent(aVisitor);
   }
 
 protected:
   nsIContent* AsContent() override { return this; }
 
+  virtual JSObject* WrapNode(JSContext *aCx, JS::Handle<JSObject*> aGivenProto) override;
+  virtual nsresult Clone(dom::NodeInfo* aNodeInfo,
+                         nsINode** aResult,
+                         bool aPreallocateChildren) const override;
+
 private:
   virtual ~nsGenConImageContent();
 
@@ -68,23 +79,42 @@ public:
 };
 
 NS_IMPL_ISUPPORTS_INHERITED(nsGenConImageContent,
-                            nsXMLElement,
+                            nsGenericHTMLElement,
                             nsIImageLoadingContent,
                             imgINotificationObserver)
 
-nsresult
+NS_IMPL_ELEMENT_CLONE(nsGenConImageContent)
-NS_NewGenConImageContent(nsIContent** aResult, already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo,
+
-                         imgRequestProxy* aImageRequest)
+namespace mozilla {
+namespace dom {
+
+already_AddRefed<nsIContent>
+CreateGenConImageContent(nsIDocument* aDocument, imgRequestProxy* aImageRequest)
 {
   NS_PRECONDITION(aImageRequest, "Must have request!");
-  nsGenConImageContent *it = new nsGenConImageContent(aNodeInfo);
+  RefPtr<NodeInfo> nodeInfo =
-  NS_ADDREF(*aResult = it);
+    aDocument->NodeInfoManager()->
+      GetNodeInfo(nsGkAtoms::mozgeneratedcontentimage,
+                  nullptr,
+                  kNameSpaceID_XHTML,
+                  nsINode::ELEMENT_NODE);
+  // Work around not being able to bind a non-const lvalue reference
+  // to an rvalue of non-reference type by just creating an rvalue
+  // reference.  And we can't change the constructor signature,
+  // because then the macro-generated Clone() method fails to compile.
+  already_AddRefed<NodeInfo>&& rvalue = nodeInfo.forget();
+  RefPtr<nsGenConImageContent> it = new nsGenConImageContent(rvalue);
   nsresult rv = it->Init(aImageRequest);
-  if (NS_FAILED(rv))
+  if (NS_FAILED(rv)) {
-    NS_RELEASE(*aResult);
+    return nullptr;
-  return rv;
   }
 
+  return it.forget();
+}
+
+} // namespace dom
+} // namespace mozilla
+
 nsGenConImageContent::~nsGenConImageContent()
 {
   DestroyImageLoadingContent();
@@ -96,7 +126,7 @@ nsGenConImageContent::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
                                  bool aCompileEventHandlers)
 {
   nsresult rv;
-  rv = nsXMLElement::BindToTree(aDocument, aParent, aBindingParent,
+  rv = nsGenericHTMLElement::BindToTree(aDocument, aParent, aBindingParent,
                                 aCompileEventHandlers);
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -109,13 +139,13 @@ void
 nsGenConImageContent::UnbindFromTree(bool aDeep, bool aNullParent)
 {
   nsImageLoadingContent::UnbindFromTree(aDeep, aNullParent);
-  nsXMLElement::UnbindFromTree(aDeep, aNullParent);
+  nsGenericHTMLElement::UnbindFromTree(aDeep, aNullParent);
 }
 
 EventStates
 nsGenConImageContent::IntrinsicState() const
 {
-  EventStates state = nsXMLElement::IntrinsicState();
+  EventStates state = nsGenericHTMLElement::IntrinsicState();
 
   EventStates imageState = nsImageLoadingContent::ImageState();
   if (imageState.HasAtLeastOneOfStates(NS_EVENT_STATE_BROKEN | NS_EVENT_STATE_USERDISABLED)) {
@@ -127,3 +157,10 @@ nsGenConImageContent::IntrinsicState() const
   imageState &= ~NS_EVENT_STATE_LOADING;
   return state | imageState;
 }
+
+JSObject*
+nsGenConImageContent::WrapNode(JSContext *aCx, JS::Handle<JSObject*> aGivenProto)
+{
+  return dom::HTMLElementBinding::Wrap(aCx, this, aGivenProto);
+}
+

dom/tests/mochitest/general/mochitest.ini

@@ -82,6 +82,7 @@ skip-if = (toolkit == 'android') # Disabled on Android, see bug 1230231
 subsuite = clipboard
 [test_bug1208217.html]
 [test_bug1313753.html]
+[test_bug1434273.html]
 [test_clientRects.html]
 [test_clipboard_disallowed.html]
 [test_clipboard_events.html]

dom/tests/mochitest/general/test_bug1434273.html

@@ -0,0 +1,36 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1434273
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 1434273</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <style>
+    #test::before { content: url(image_200.png); }
+  </style>
+  <script type="application/javascript">
+  SimpleTest.waitForExplicitFinish();
+
+  /** Test for Bug 1434273 **/
+  addLoadEvent(function() {
+    synthesizeMouse($("test"), 100, 100, {});
+    ok(true, "We did not crash!");
+    SimpleTest.finish();
+  });
+
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1434273">Mozilla Bug 1434273</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+</pre>
+</body>
+</html>

layout/base/nsCSSFrameConstructor.cpp

@@ -1748,15 +1748,7 @@ nsCSSFrameConstructor::CreateGeneratedContent(nsFrameConstructorState& aState,
       // Create an image content object and pass it the image request.
       // XXX Check if it's an image type we can handle...
 
-      RefPtr<NodeInfo> nodeInfo;
+      return CreateGenConImageContent(mDocument, image);
-      nodeInfo = mDocument->NodeInfoManager()->
-        GetNodeInfo(nsGkAtoms::mozgeneratedcontentimage, nullptr,
-                    kNameSpaceID_XHTML, nsINode::ELEMENT_NODE);
-
-      nsCOMPtr<nsIContent> content;
-      NS_NewGenConImageContent(getter_AddRefs(content), nodeInfo.forget(),
-                               image);
-      return content.forget();
     }
 
     case eStyleContentType_String: