From 88ce7f0c92ff87620c2b4fe6990e66ac47fe1ba7 Mon Sep 17 00:00:00 2001
From: Dorel Luca <dluca@mozilla.com>
Date: Fri, 26 Jun 2020 14:21:41 +0300
Subject: [PATCH] Backed out changeset c6d8b979af47 (bug 1644140) for causing
 Bug 1644213 to regress

---
 docshell/base/nsDocShell.cpp | 58 ++++++++++++++++++++++++++++--------
 docshell/base/nsDocShell.h   |  4 +++
 2 files changed, 50 insertions(+), 12 deletions(-)

diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index 5c677c08b248..161fa809b2b3 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -2817,10 +2817,29 @@ nsDocShell::AddChildSHEntry(nsISHEntry* aCloneRef, nsISHEntry* aNewEntry,
       rv = mOSHE->AddChild(aNewEntry, aChildOffset, UseRemoteSubframes());
     }
   } else {
-    RefPtr<ChildSHistory> shistory = GetRootSessionHistory();
-    if (shistory) {
-      rv = shistory->LegacySHistory()->AddChildSHEntryHelper(
-          aCloneRef, aNewEntry, mBrowsingContext, aCloneChildren);
+    rv = AddChildSHEntryInternal(aCloneRef, aNewEntry, aChildOffset, aLoadType,
+                                 aCloneChildren);
+  }
+  return rv;
+}
+
+nsresult nsDocShell::AddChildSHEntryInternal(nsISHEntry* aCloneRef,
+                                             nsISHEntry* aNewEntry,
+                                             int32_t aChildOffset,
+                                             uint32_t aLoadType,
+                                             bool aCloneChildren) {
+  nsresult rv = NS_OK;
+  if (GetSessionHistory()) {
+    rv = GetSessionHistory()->LegacySHistory()->AddChildSHEntryHelper(
+        aCloneRef, aNewEntry, mBrowsingContext, aCloneChildren);
+  } else {
+    /* Just pass this along */
+    nsCOMPtr<nsIDocShell> parent =
+        do_QueryInterface(GetAsSupports(mParent), &rv);
+    if (parent) {
+      rv = static_cast<nsDocShell*>(parent.get())
+               ->AddChildSHEntryInternal(aCloneRef, aNewEntry, aChildOffset,
+                                         aLoadType, aCloneChildren);
     }
   }
   return rv;
@@ -2865,7 +2884,8 @@ nsresult nsDocShell::AddChildSHEntryToParent(nsISHEntry* aNewEntry,
 
 NS_IMETHODIMP
 nsDocShell::RemoveFromSessionHistory() {
-  RefPtr<ChildSHistory> sessionHistory = GetRootSessionHistory();
+  RefPtr<ChildSHistory> sessionHistory =
+      mBrowsingContext->Top()->GetChildSessionHistory();
   if (!sessionHistory) {
     return NS_OK;
   }
@@ -9937,7 +9957,8 @@ bool nsDocShell::OnNewURI(nsIURI* aURI, nsIChannel* aChannel,
 
   // Create SH Entry (mLSHE) only if there is a SessionHistory object in the
   // in the root browsing context.
-  RefPtr<ChildSHistory> rootSH = GetRootSessionHistory();
+  RefPtr<ChildSHistory> rootSH =
+      mBrowsingContext->Top()->GetChildSessionHistory();
   if (!rootSH) {
     updateSHistory = false;
     updateGHistory = false;  // XXX Why global history too?
@@ -10533,13 +10554,16 @@ nsresult nsDocShell::AddToSessionHistory(
   nsresult rv = NS_OK;
   nsCOMPtr<nsISHEntry> entry;
 
+  // Get a handle to the root docshell
+  nsCOMPtr<nsIDocShellTreeItem> root;
+  GetInProcessSameTypeRootTreeItem(getter_AddRefs(root));
   /*
    * If this is a LOAD_FLAGS_REPLACE_HISTORY in a subframe, we use
    * the existing SH entry in the page and replace the url and
    * other vitalities.
    */
   if (LOAD_TYPE_HAS_FLAGS(mLoadType, LOAD_FLAGS_REPLACE_HISTORY) &&
-      !mBrowsingContext->IsTop()) {
+      root != static_cast<nsIDocShellTreeItem*>(this)) {
     // This is a subframe
     entry = mOSHE;
     if (entry) {
@@ -10549,7 +10573,10 @@ nsresult nsDocShell::AddToSessionHistory(
 
   // Create a new entry if necessary.
   if (!entry) {
-    RefPtr<ChildSHistory> shistory = GetRootSessionHistory();
+    nsCOMPtr<nsIWebNavigation> webnav = do_QueryInterface(root);
+    NS_ENSURE_TRUE(webnav, NS_ERROR_FAILURE);
+
+    RefPtr<ChildSHistory> shistory = webnav->GetSessionHistory();
     entry = new nsSHEntry(shistory ? shistory->LegacySHistory() : nullptr);
   }
 
@@ -10678,7 +10705,7 @@ nsresult nsDocShell::AddToSessionHistory(
                 resultPrincipalURI, loadReplace, referrerInfo, srcdoc,
                 srcdocEntry, baseURI, saveLayoutState, expired);
 
-  if (mBrowsingContext->IsTop() && GetSessionHistory()) {
+  if (root == static_cast<nsIDocShellTreeItem*>(this) && GetSessionHistory()) {
     bool shouldPersist = ShouldAddToSessionHistory(aURI, aChannel);
     Maybe<int32_t> previousEntryIndex;
     Maybe<int32_t> loadedEntryIndex;
@@ -10879,9 +10906,16 @@ already_AddRefed<nsISHEntry> nsDocShell::SetHistoryEntry(
 }
 
 already_AddRefed<ChildSHistory> nsDocShell::GetRootSessionHistory() {
-  RefPtr<ChildSHistory> childSHistory =
-      mBrowsingContext->Top()->GetChildSessionHistory();
-  return childSHistory.forget();
+  nsCOMPtr<nsIDocShellTreeItem> root;
+  nsresult rv = GetInProcessSameTypeRootTreeItem(getter_AddRefs(root));
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return nullptr;
+  }
+  nsCOMPtr<nsIWebNavigation> webnav = do_QueryInterface(root);
+  if (!webnav) {
+    return nullptr;
+  }
+  return webnav->GetSessionHistory();
 }
 
 nsresult nsDocShell::GetHttpChannel(nsIChannel* aChannel,
diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
index 8f9b84fac65c..2d02f8e3762a 100644
--- a/docshell/base/nsDocShell.h
+++ b/docshell/base/nsDocShell.h
@@ -603,6 +603,10 @@ class nsDocShell final : public nsDocLoader,
   nsresult AddChildSHEntryToParent(nsISHEntry* aNewEntry, int32_t aChildOffset,
                                    bool aCloneChildren);
 
+  nsresult AddChildSHEntryInternal(nsISHEntry* aCloneRef, nsISHEntry* aNewEntry,
+                                   int32_t aChildOffset, uint32_t aLoadType,
+                                   bool aCloneChildren);
+
   // Call this method to swap in a new history entry to m[OL]SHE, rather than
   // setting it directly. This completes the navigation in all docshells
   // in the case of a subframe navigation.