292247 - [FIX]XUL overlays violate BindToTree/UnbindFromTree invariants

Status: RESOLVED FIXED

(Core :: XUL, defect, P1)

Description

[Boris Zbarsky [:bzbarsky]]

XUL overlays violate the fundamental invariant that a node needs to be unbound
before being bound to a different tree.  This means that we assert on any
non-XUL content in an overlay.  Once the mDocument mess with XUL is fixed and
the same asserts are enabled for XUL we will assert once for every node in the
overlay during an overlay merge.  That would make startup quite fun.

I'm not really sure who, if anyone, even owns the overlay code... does anyone?

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Overlay

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: Testcase

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Proposed patch

So the problem was that the mOverlay node of the overlay forward reference
thought it was in a document.  The simple fix is to remove the silly hack in
nsXULElement::Create that sets the IN_DOCUMENT flag on newly-created nodes.  I
checked all callers of Create and that should be just fine.

The nsXULDocument change is just removing unused code -- no one uses tempID.

Comment 4

[Johnny Stenback (:jst)]

Comment on attachment 182088 [details] [diff] [review]
Proposed patch

sr=jst

Comment 5

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 182088 [details] [diff] [review]
Proposed patch

Requesting approval.  This should be pretty safe and get us another step closer
to assert-freedom...

Comment 6

[chris hofmann]

Comment on attachment 182088 [details] [diff] [review]
Proposed patch

a=chofmann

Comment 7

[Boris Zbarsky [:bzbarsky]]

Fixed.

Comment 8

[Boris Zbarsky [:bzbarsky]]

*** Bug 293844 has been marked as a duplicate of this bug. ***