refuse to spawn new windows if you're currently being destroyed. bug 115969 r=jaggernaut,jst

xpfe/appshell/src/nsXULWindow.cpp

@@ -97,10 +97,12 @@ static NS_DEFINE_CID(kWindowMediatorCID, NS_WINDOWMEDIATOR_CID);
 
 nsXULWindow::nsXULWindow() : mChromeTreeOwner(nsnull), 
    mContentTreeOwner(nsnull), mPrimaryContentTreeOwner(nsnull),
-   mContinueModalLoop(PR_FALSE), mModalStatus(NS_OK), mChromeLoaded(PR_FALSE), 
+   mModalStatus(NS_OK), mContinueModalLoop(PR_FALSE),
+   mDebuting(PR_FALSE), mChromeLoaded(PR_FALSE), 
    mShowAfterLoad(PR_FALSE), mIntrinsicallySized(PR_FALSE),
    mCenterAfterLoad(PR_FALSE), mIsHiddenWindow(PR_FALSE),
-   mHadChildWindow(PR_FALSE), mZlevel(nsIXULWindow::normalZ)
+   mHadChildWindow(PR_FALSE), mBeingDestroyed(PR_FALSE),
+   mZlevel(nsIXULWindow::normalZ)
 {
   NS_INIT_REFCNT();
 }
@@ -306,6 +308,7 @@ NS_IMETHODIMP nsXULWindow::Create()
 
 NS_IMETHODIMP nsXULWindow::Destroy()
 {
+   mBeingDestroyed = PR_TRUE;
    if(!mWindow)
       return NS_OK;
 
@@ -1265,6 +1268,13 @@ NS_IMETHODIMP nsXULWindow::CreateNewWindow(PRInt32 aChromeFlags,
 {
   NS_ENSURE_ARG_POINTER(_retval);
 
+  /* Prevent windows being shut down from opening new windows in their
+     onUnload handler. This is abused by many websites (you're thinking
+     porn sites, but I should also mention CNN) and in my opinion just
+     shouldn't work. If you think it should, see bugzilla bug 115969). */
+  if (mBeingDestroyed)
+    return NS_ERROR_FAILURE;
+
   if (aChromeFlags & nsIWebBrowserChrome::CHROME_OPENAS_CHROME)
     return CreateNewChromeWindow(aChromeFlags, _retval);
   return CreateNewContentWindow(aChromeFlags, _retval);

xpfe/appshell/src/nsXULWindow.h

@@ -111,15 +111,16 @@ protected:
    nsCOMPtr<nsIPrompt>     mPrompter;
    nsCOMPtr<nsIAuthPrompt> mAuthPrompter;
    nsVoidArray             mContentShells;
-   PRBool                  mContinueModalLoop;
    nsresult                mModalStatus;
-   PRBool                  mDebuting;       // being made visible right now
+   PRPackedBool            mContinueModalLoop;
-   PRBool                  mChromeLoaded; // True when chrome has loaded
+   PRPackedBool            mDebuting;       // being made visible right now
-   PRBool                  mShowAfterLoad;
+   PRPackedBool            mChromeLoaded; // True when chrome has loaded
-   PRBool                  mIntrinsicallySized; 
+   PRPackedBool            mShowAfterLoad;
-   PRBool                  mCenterAfterLoad;
+   PRPackedBool            mIntrinsicallySized; 
-   PRBool                  mIsHiddenWindow;
+   PRPackedBool            mCenterAfterLoad;
-   PRBool                  mHadChildWindow;
+   PRPackedBool            mIsHiddenWindow;
+   PRPackedBool            mHadChildWindow;
+   PRPackedBool            mBeingDestroyed;
    unsigned long           mZlevel;
 };