From 3038ffdea7f479ab0e5c60190ccd8eb3ff73f5d0 Mon Sep 17 00:00:00 2001
From: Peter Van der Beken <peterv@propagandism.org>
Date: Wed, 9 Sep 2020 16:49:59 +0000
Subject: [PATCH] Bug 1663977 - Null out the parent pointer of
 SessionHistoryEntry objects if their parent dies. r=smaug

Differential Revision: https://phabricator.services.mozilla.com/D89629
---
 docshell/shistory/SessionHistoryEntry.cpp | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/docshell/shistory/SessionHistoryEntry.cpp b/docshell/shistory/SessionHistoryEntry.cpp
index 7ab4dc06b379..295db868d0fe 100644
--- a/docshell/shistory/SessionHistoryEntry.cpp
+++ b/docshell/shistory/SessionHistoryEntry.cpp
@@ -322,6 +322,13 @@ SessionHistoryEntry::SessionHistoryEntry(const SessionHistoryEntry& aEntry)
       mID(aEntry.mID) {}
 
 SessionHistoryEntry::~SessionHistoryEntry() {
+  // Null out the mParent pointers on all our kids.
+  for (nsISHEntry* entry : mChildren) {
+    if (entry) {
+      entry->SetParent(nullptr);
+    }
+  }
+
   if (sLoadIdToEntry) {
     sLoadIdToEntry->RemoveIf(
         [this](auto& aIter) { return aIter.Data() == this; });