Bug 288873. Don't let nsSubDocumentFrame tear down a presentation it didn't build. r+sr=bzbarsky,a=asa.

content/events/src/nsEventStateManager.cpp

@@ -2643,6 +2643,9 @@ nsEventStateManager::NotifyMouseOver(nsGUIEvent* aEvent, nsIContent* aContent)
 void
 nsEventStateManager::GenerateMouseEnterExit(nsGUIEvent* aEvent)
 {
+  if (!mDocument)
+    return;
+
   // Hold onto old target content through the event and reset after.
   nsCOMPtr<nsIContent> targetBeforeEvent = mCurrentTargetContent;
 
@@ -2652,6 +2655,12 @@ nsEventStateManager::GenerateMouseEnterExit(nsGUIEvent* aEvent)
       // Get the target content target (mousemove target == mouseover target)
       nsCOMPtr<nsIContent> targetElement;
       GetEventTargetContent(aEvent, getter_AddRefs(targetElement));
+      if (!targetElement) {
+        // We're always over the document root, even if we're only
+        // over dead space in a page (whose frame is not associated with
+        // any content) or in print preview dead space
+        targetElement = mDocument->GetRootContent();
+      }
       NS_ASSERTION(targetElement, "Mouse move must have some target content");
       if (targetElement) {
         NotifyMouseOver(aEvent, targetElement);

layout/base/nsDocumentViewer.cpp

@@ -1652,7 +1652,8 @@ DocumentViewerImpl::Hide(void)
     // right now returning from print and the layout frame that was
     // created for this document is being destroyed. In such a case we
     // ignore the Hide() call.
-
+    // XXX The above statement is a lie. We do not check our parents.
+    // in fact it always returns false for subdocuments.
     return NS_OK;
   }
 
@@ -1663,7 +1664,8 @@ DocumentViewerImpl::Hide(void)
     // we're right now returning from print preview and the layout
     // frame that was created for this document is being destroyed. In
     // such a case we ignore the Hide() call.
-
+    // XXX The above statement is a lie. We do not check our parents.
+    // in fact it always returns false for subdocuments.
     return NS_OK;
   }
 
@@ -3376,6 +3378,7 @@ DocumentViewerImpl::GetGlobalPrintSettings(nsIPrintSettings * *aGlobalPrintSetti
 }
 
 /* readonly attribute boolean doingPrint; */
+// XXX This always returns PR_FALSE for subdocuments
 NS_IMETHODIMP
 DocumentViewerImpl::GetDoingPrint(PRBool *aDoingPrint)
 {
@@ -3384,6 +3387,7 @@ DocumentViewerImpl::GetDoingPrint(PRBool *aDoingPrint)
   
   *aDoingPrint = PR_FALSE;
   if (mPrintEngine) {
+    // XXX shouldn't this be GetDoingPrint() ?
     return mPrintEngine->GetDoingPrintPreview(aDoingPrint);
   } 
   return NS_OK;
@@ -3393,6 +3397,7 @@ DocumentViewerImpl::GetDoingPrint(PRBool *aDoingPrint)
 }
 
 /* readonly attribute boolean doingPrintPreview; */
+// XXX This always returns PR_FALSE for subdocuments
 NS_IMETHODIMP
 DocumentViewerImpl::GetDoingPrintPreview(PRBool *aDoingPrintPreview)
 {
@@ -3603,6 +3608,7 @@ DocumentViewerImpl::SetIsPrintingInDocShellTree(nsIDocShellTreeNode* aParentNode
 #endif // NS_PRINTING
 
 //------------------------------------------------------------
+// XXX this always returns PR_FALSE for subdocuments
 PRBool
 DocumentViewerImpl::GetIsPrinting()
 {
@@ -3632,7 +3638,8 @@ DocumentViewerImpl::SetIsPrinting(PRBool aIsPrinting)
 
 //------------------------------------------------------------
 // The PrintEngine holds the current value
-// this called from inside the DocViewer
+// this called from inside the DocViewer.
+// XXX it always returns PR_FALSE for subdocuments
 PRBool
 DocumentViewerImpl::GetIsPrintPreview()
 {

layout/generic/nsFrameFrame.cpp

@@ -158,15 +158,16 @@ protected:
   virtual PRIntn GetSkipSides() const;
 
   nsCOMPtr<nsIFrameLoader> mFrameLoader;
+  nsIView* mInnerView;
+  PRPackedBool mDidCreateDoc;
   PRPackedBool mOwnsFrameLoader;
   PRPackedBool mIsInline;
-  nsIView* mInnerView;
 };
 
 nsSubDocumentFrame::nsSubDocumentFrame()
-  : nsLeafFrame(), mOwnsFrameLoader(PR_FALSE)
+  : nsLeafFrame(), mDidCreateDoc(PR_FALSE), mOwnsFrameLoader(PR_FALSE),
+    mIsInline(PR_FALSE)
 {
-  mIsInline = PR_FALSE;
 }
 
 #ifdef ACCESSIBILITY
@@ -274,6 +275,7 @@ nsSubDocumentFrame::Init(nsPresContext* aPresContext,
   if (shouldCreateDoc) {
     rv = ShowDocShell();
     NS_ENSURE_SUCCESS(rv,rv);
+    mDidCreateDoc = PR_TRUE;
   }
 
   return NS_OK;
@@ -534,7 +536,7 @@ NS_NewSubDocumentFrame(nsIPresShell* aPresShell, nsIFrame** aNewFrame)
 NS_IMETHODIMP
 nsSubDocumentFrame::Destroy(nsPresContext* aPresContext)
 {
-  if (mFrameLoader) {
+  if (mFrameLoader && mDidCreateDoc) {
     // Get the content viewer through the docshell, but don't call
     // GetDocShell() since we don't want to create one if we don't
     // have one.
@@ -584,6 +586,8 @@ nsSize nsSubDocumentFrame::GetMargin()
   return result;
 }
 
+// XXX this should be called ObtainDocShell or something like that,
+// to indicate that it could have side effects
 NS_IMETHODIMP
 nsSubDocumentFrame::GetDocShell(nsIDocShell **aDocShell)
 {