From 0f4f44ed978d28359a2c177538b614c10d237170 Mon Sep 17 00:00:00 2001
From: "jonas%sicking.cc"
 <jonas%sicking.cc@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Tue, 17 Nov 2009 02:55:18 +0000
Subject: [PATCH] Bug 293347: Disable document.write during xslt processing.
 r=peterv sr=jst

git-svn-id: svn://10.0.0.236/trunk@259001 18797224-902f-48f8-a5cc-f745e15eee43
---
 .../html/document/src/nsHTMLDocument.cpp      |  9 +++---
 .../html/document/src/nsHTMLDocument.h        |  8 ++++-
 .../html/document/src/nsIHTMLDocument.h       | 16 ++++++++++
 .../xml/document/src/nsXMLContentSink.cpp     | 11 +++++++
 mozilla/content/xml/document/test/Makefile.in |  3 ++
 .../xml/document/test/file_bug293347.xml      |  2 ++
 .../xml/document/test/file_bug293347xslt.xml  | 19 ++++++++++++
 .../xml/document/test/test_bug293347.html     | 31 +++++++++++++++++++
 8 files changed, 94 insertions(+), 5 deletions(-)
 create mode 100644 mozilla/content/xml/document/test/file_bug293347.xml
 create mode 100644 mozilla/content/xml/document/test/file_bug293347xslt.xml
 create mode 100644 mozilla/content/xml/document/test/test_bug293347.html

diff --git a/mozilla/content/html/document/src/nsHTMLDocument.cpp b/mozilla/content/html/document/src/nsHTMLDocument.cpp
index 353318b1cf7..83c90b13c78 100644
--- a/mozilla/content/html/document/src/nsHTMLDocument.cpp
+++ b/mozilla/content/html/document/src/nsHTMLDocument.cpp
@@ -458,10 +458,11 @@ NS_IMPL_RELEASE_INHERITED(nsHTMLDocument, nsDocument)
 
 // QueryInterface implementation for nsHTMLDocument
 NS_INTERFACE_TABLE_HEAD_CYCLE_COLLECTION_INHERITED(nsHTMLDocument)
-  NS_INTERFACE_TABLE_INHERITED3(nsHTMLDocument,
+  NS_INTERFACE_TABLE_INHERITED4(nsHTMLDocument,
                                 nsIHTMLDocument,
                                 nsIDOMHTMLDocument,
-                                nsIDOMNSHTMLDocument)
+                                nsIDOMNSHTMLDocument,
+                                nsIHTMLDocument_1_9_1_BRANCH)
   NS_INTERFACE_TABLE_TO_MAP_SEGUE
   NS_INTERFACE_MAP_ENTRY_CONTENT_CLASSINFO(HTMLDocument)
 NS_INTERFACE_MAP_END_INHERITING(nsDocument)
@@ -2081,7 +2082,7 @@ nsHTMLDocument::SetCookie(const nsAString& aCookie)
 nsresult
 nsHTMLDocument::OpenCommon(const nsACString& aContentType, PRBool aReplace)
 {
-  if (IsXHTML()) {
+  if (IsXHTML() || mDisableDocWrite) {
     // No calling document.open() on XHTML
 
     return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
@@ -2460,7 +2461,7 @@ nsHTMLDocument::WriteCommon(const nsAString& aText,
     (mWriteLevel > NS_MAX_DOCUMENT_WRITE_DEPTH || mTooDeepWriteRecursion);
   NS_ENSURE_STATE(!mTooDeepWriteRecursion);
 
-  if (IsXHTML()) {
+  if (IsXHTML() || mDisableDocWrite) {
     // No calling document.write*() on XHTML!
 
     return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
diff --git a/mozilla/content/html/document/src/nsHTMLDocument.h b/mozilla/content/html/document/src/nsHTMLDocument.h
index fe342295028..4c22783bbe8 100644
--- a/mozilla/content/html/document/src/nsHTMLDocument.h
+++ b/mozilla/content/html/document/src/nsHTMLDocument.h
@@ -68,7 +68,7 @@ class nsIDocumentCharsetInfo;
 class nsICacheEntryDescriptor;
 
 class nsHTMLDocument : public nsDocument,
-                       public nsIHTMLDocument,
+                       public nsIHTMLDocument_1_9_1_BRANCH,
                        public nsIDOMHTMLDocument,
                        public nsIDOMNSHTMLDocument
 {
@@ -193,6 +193,10 @@ public:
   {
     return mDefaultNamespaceID == kNameSpaceID_XHTML;
   }
+  virtual void SetDocWriteDisabled(PRBool aDisabled)
+  {
+    mDisableDocWrite = aDisabled;
+  }
 
 #ifdef DEBUG
   virtual nsresult CreateElem(nsIAtom *aName, nsIAtom *aPrefix,
@@ -344,6 +348,8 @@ protected:
 
   PRPackedBool mTooDeepWriteRecursion;
 
+  PRPackedBool mDisableDocWrite;
+
   PRBool IdTableIsLive() const {
     // live if we've had over 63 misses
     return (mIdMissCount & 0x40) != 0;
diff --git a/mozilla/content/html/document/src/nsIHTMLDocument.h b/mozilla/content/html/document/src/nsIHTMLDocument.h
index 583a44b33f3..b96627037ea 100644
--- a/mozilla/content/html/document/src/nsIHTMLDocument.h
+++ b/mozilla/content/html/document/src/nsIHTMLDocument.h
@@ -194,4 +194,20 @@ public:
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsIHTMLDocument, NS_IHTMLDOCUMENT_IID)
 
+// 498ec6d4-a724-4779-9ede-9c71923c2da6
+#define NS_IHTMLDOCUMENT_1_9_1_BRANCH_IID \
+{ 0x498ec6d4, 0xa724, 0x4779, \
+  { 0x9e, 0xde, 0x9c, 0x71, 0x92, 0x3c, 0x2d, 0xa6 } }
+
+class nsIHTMLDocument_1_9_1_BRANCH : public nsIHTMLDocument
+{
+public:
+  NS_DECLARE_STATIC_IID_ACCESSOR(NS_IHTMLDOCUMENT_1_9_1_BRANCH_IID)
+
+  virtual void SetDocWriteDisabled(PRBool aDisabled) = 0;
+};
+
+NS_DEFINE_STATIC_IID_ACCESSOR(nsIHTMLDocument_1_9_1_BRANCH,
+                              NS_IHTMLDOCUMENT_1_9_1_BRANCH_IID)
+
 #endif /* nsIHTMLDocument_h___ */
diff --git a/mozilla/content/xml/document/src/nsXMLContentSink.cpp b/mozilla/content/xml/document/src/nsXMLContentSink.cpp
index ff105ad50f2..5f60279c155 100644
--- a/mozilla/content/xml/document/src/nsXMLContentSink.cpp
+++ b/mozilla/content/xml/document/src/nsXMLContentSink.cpp
@@ -96,6 +96,7 @@
 #include "nsIDOMProcessingInstruction.h"
 #include "nsNodeUtils.h"
 #include "nsIScriptGlobalObject.h"
+#include "nsIHTMLDocument.h"
 #include "nsEventDispatcher.h"
 #include "mozAutoDocUpdate.h"
 
@@ -392,6 +393,12 @@ nsXMLContentSink::OnDocumentCreated(nsIDocument* aResultDocument)
 {
   NS_ENSURE_ARG(aResultDocument);
 
+  nsCOMPtr<nsIHTMLDocument_1_9_1_BRANCH> htmlDoc =
+    do_QueryInterface(aResultDocument);
+  if (htmlDoc) {
+    htmlDoc->SetDocWriteDisabled(PR_TRUE);
+  }
+
   nsCOMPtr<nsIContentViewer> contentViewer;
   mDocShell->GetContentViewer(getter_AddRefs(contentViewer));
   if (contentViewer) {
@@ -433,6 +440,10 @@ nsXMLContentSink::OnTransformDone(nsresult aResult,
     // Transform succeeded or it failed and we have an error
     // document to display.
     mDocument = aResultDocument;
+    nsCOMPtr<nsIHTMLDocument_1_9_1_BRANCH> htmlDoc = do_QueryInterface(mDocument);
+    if (htmlDoc) {
+      htmlDoc->SetDocWriteDisabled(PR_FALSE);
+    }
   }
 
   originalDocument->ScriptLoader()->RemoveObserver(this);
diff --git a/mozilla/content/xml/document/test/Makefile.in b/mozilla/content/xml/document/test/Makefile.in
index 136c8fab52e..6ee67bf4df7 100644
--- a/mozilla/content/xml/document/test/Makefile.in
+++ b/mozilla/content/xml/document/test/Makefile.in
@@ -49,6 +49,9 @@ _TEST_FILES = 	test_bug232004.xhtml \
 		test_bug355213.xhtml \
 		test_bug392338.html \
 		test_bug399502.xhtml \
+		test_bug293347.html \
+		file_bug293347.xml \
+		file_bug293347xslt.xml \
 		$(NULL)
 
 libs:: $(_TEST_FILES)
diff --git a/mozilla/content/xml/document/test/file_bug293347.xml b/mozilla/content/xml/document/test/file_bug293347.xml
new file mode 100644
index 00000000000..d041450e2f1
--- /dev/null
+++ b/mozilla/content/xml/document/test/file_bug293347.xml
@@ -0,0 +1,2 @@
+<?xml-stylesheet type="text/xsl" href="file_bug293347xslt.xml"?>
+<doc/>
\ No newline at end of file
diff --git a/mozilla/content/xml/document/test/file_bug293347xslt.xml b/mozilla/content/xml/document/test/file_bug293347xslt.xml
new file mode 100644
index 00000000000..44df7749e00
--- /dev/null
+++ b/mozilla/content/xml/document/test/file_bug293347xslt.xml
@@ -0,0 +1,19 @@
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+  <xsl:template match="/doc">
+    <html>
+      <body>
+        <div></div>
+        <div>
+          <script>
+            didThrow = false;
+            try {
+              document.write("shrimp");
+            } catch (e) {
+              didThrow = true;
+            }
+          </script>
+        </div>
+      </body>
+    </html>
+  </xsl:template>
+</xsl:stylesheet>
diff --git a/mozilla/content/xml/document/test/test_bug293347.html b/mozilla/content/xml/document/test/test_bug293347.html
new file mode 100644
index 00000000000..016f70ce00d
--- /dev/null
+++ b/mozilla/content/xml/document/test/test_bug293347.html
@@ -0,0 +1,31 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=293347
+-->
+<head>
+  <title>Test for Bug 293347</title>
+  <script type="text/javascript" src="/MochiKit/packed.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=293347">Mozilla Bug 293347</a>
+<p id="display"></p>
+<iframe src="file_bug293347.xml" onload="done(this)"></iframe>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+
+SimpleTest.waitForExplicitFinish();
+
+function done(iframe) {
+  win = iframe.contentWindow;
+  is(win.document.getElementsByTagName("div").length, 2, "doc still intact");
+  is(win.didThrow, true, "doc.write throwing");
+  SimpleTest.finish();
+}
+
+</script>
+</pre>
+</body>
+</html>