From 7ad74eab05c30a2ca27d64901ccbf417d2acc803 Mon Sep 17 00:00:00 2001
From: James Kitchener <jkitch.bug@gmail.com>
Date: Tue, 16 Jul 2013 10:32:39 -0400
Subject: [PATCH] Bug 893537 - Crash after unloading an iframe with srcdoc
 attribute set. r=bz

---
 content/html/content/test/Makefile.in         |  2 +
 content/html/content/test/file_bug893537.html |  9 ++++
 content/html/content/test/test_bug893537.html | 42 +++++++++++++++++++
 docshell/shistory/src/nsSHEntry.cpp           |  3 ++
 4 files changed, 56 insertions(+)
 create mode 100644 content/html/content/test/file_bug893537.html
 create mode 100644 content/html/content/test/test_bug893537.html
diff --git a/content/html/content/test/Makefile.in b/content/html/content/test/Makefile.in
index 0348eb562d29..e7474676d72d 100644
--- a/content/html/content/test/Makefile.in
+++ b/content/html/content/test/Makefile.in
@@ -390,6 +390,8 @@ MOCHITEST_FILES = \
 		file_srcdoc.html \
 		test_srcdoc-2.html \
 		file_srcdoc-2.html \
+		test_bug893537.html \
+		file_bug893537.html \
 		$(NULL)
 
 MOCHITEST_CHROME_FILES = \
diff --git a/content/html/content/test/file_bug893537.html b/content/html/content/test/file_bug893537.html
new file mode 100644
index 000000000000..1dcb454ff113
--- /dev/null
+++ b/content/html/content/test/file_bug893537.html
@@ -0,0 +1,9 @@
+<!doctype html>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=893537
+-->
+<body>
+<iframe id="iframe" src="data:text/html;charset=US-ASCII,Goodbye World" srcdoc="Hello World"></iframe>
+</body>
+</html>
diff --git a/content/html/content/test/test_bug893537.html b/content/html/content/test/test_bug893537.html
new file mode 100644
index 000000000000..9ca4f9780be7
--- /dev/null
+++ b/content/html/content/test/test_bug893537.html
@@ -0,0 +1,42 @@
+<!doctype html>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=893537
+-->
+    <head>
+<title>Test for crash caused by unloading and reloading srcdoc iframes</title>
+<script src="/tests/SimpleTest/SimpleTest.js"></script>
+<link rel="stylesheet" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=893537">Mozilla Bug 893537</a>
+
+<iframe id="pframe" src="file_bug893537.html"></iframe>
+
+<pre id="test">
+<script>
+  SimpleTest.waitForExplicitFinish();
+  var pframe = $("pframe");
+  
+  var loadState = 1;
+  pframe.contentWindow.addEventListener("load", function () {
+
+    if (loadState == 1) {
+      var iframe = pframe.contentDocument.getElementById("iframe");
+      iframe.removeAttribute("srcdoc");
+      loadState = 2;
+    }
+    if (loadState == 2) {
+      SimpleTest.executeSoon(function () { pframe.contentWindow.location.reload() });
+      loadState = 3;
+    }
+    if (loadState == 3) {
+      ok(true, "This is a mochitest implementation of a crashtest.  To finish is to pass");
+      SimpleTest.finish();
+    }
+  });
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/docshell/shistory/src/nsSHEntry.cpp b/docshell/shistory/src/nsSHEntry.cpp
index 3a8110912685..a6278f62844e 100644
--- a/docshell/shistory/src/nsSHEntry.cpp
+++ b/docshell/shistory/src/nsSHEntry.cpp
@@ -374,6 +374,9 @@ nsSHEntry::Create(nsIURI * aURI, const nsAString &aTitle,
   //By default the page is not expired
   mShared->mExpired = false;
 
+  mIsSrcdocEntry = false;
+  mSrcdocData = NullString();
+
   return NS_OK;
 }
 
