diff --git a/dom/base/Document.cpp b/dom/base/Document.cpp index 372c1a36ab06..8f139475c2e3 100644 --- a/dom/base/Document.cpp +++ b/dom/base/Document.cpp @@ -13166,16 +13166,18 @@ class PendingFullscreenChangeList { class Iterator { public: explicit Iterator(Document* aDoc, IteratorOption aOption) - : mCurrent(PendingFullscreenChangeList::sList.getFirst()), - mRootShellForIteration(aDoc->GetDocShell()) { + : mCurrent(PendingFullscreenChangeList::sList.getFirst()) { if (mCurrent) { - if (mRootShellForIteration && aOption == eDocumentsWithSameRoot) { - // Use a temporary to avoid undefined behavior from passing - // mRootShellForIteration. - nsCOMPtr root; - mRootShellForIteration->GetInProcessRootTreeItem( - getter_AddRefs(root)); - mRootShellForIteration = std::move(root); + if (aDoc->GetBrowsingContext()) { + mRootBCForIteration = aDoc->GetBrowsingContext(); + if (aOption == eDocumentsWithSameRoot) { + RefPtr bc = + GetParentIgnoreChromeBoundary(mRootBCForIteration); + while (bc) { + mRootBCForIteration = bc; + bc = GetParentIgnoreChromeBoundary(mRootBCForIteration); + } + } } SkipToNextMatch(); } @@ -13189,6 +13191,16 @@ class PendingFullscreenChangeList { bool AtEnd() const { return mCurrent == nullptr; } private: + already_AddRefed GetParentIgnoreChromeBoundary( + BrowsingContext* aBC) { + // Chrome BrowsingContexts are only available in the parent process, so if + // we're in a content process, we only worry about the context tree. + if (XRE_IsParentProcess()) { + return aBC->Canonical()->GetParentCrossChromeBoundary(); + } + return do_AddRef(aBC->GetParent()); + } + UniquePtr TakeAndNextInternal() { FullscreenChange* thisChange = mCurrent; MOZ_ASSERT(thisChange->Type() == T::kType); @@ -13198,21 +13210,19 @@ class PendingFullscreenChangeList { void SkipToNextMatch() { while (mCurrent) { if (mCurrent->Type() == T::kType) { - nsCOMPtr docShell = - mCurrent->Document()->GetDocShell(); - if (!docShell) { + RefPtr bc = + mCurrent->Document()->GetBrowsingContext(); + if (!bc) { // Always automatically drop fullscreen changes which are // from a document detached from the doc shell. UniquePtr change = TakeAndNextInternal(); change->MayRejectPromise("Document is not active"); continue; } - while (docShell && docShell != mRootShellForIteration) { - nsCOMPtr parent; - docShell->GetInProcessParent(getter_AddRefs(parent)); - docShell = std::move(parent); + while (bc && bc != mRootBCForIteration) { + bc = GetParentIgnoreChromeBoundary(bc); } - if (docShell) { + if (bc) { break; } } @@ -13223,7 +13233,7 @@ class PendingFullscreenChangeList { } FullscreenChange* mCurrent; - nsCOMPtr mRootShellForIteration; + RefPtr mRootBCForIteration; }; private: @@ -13966,6 +13976,7 @@ bool Document::FullscreenElementReadyCheck(FullscreenRequest& aRequest) { } static nsCOMPtr GetRootWindow(Document* aDoc) { + MOZ_ASSERT(XRE_IsParentProcess()); nsIDocShell* docShell = aDoc->GetDocShell(); if (!docShell) { return nullptr;