Bug 1401379 - Part 8: Avoid using mDocShell to check if the window has been closed, r=smaug

MozReview-Commit-ID: CyNanVzyyNp

docshell/base/nsDocShell.cpp

@@ -828,6 +828,7 @@ nsDocShell::nsDocShell()
   , mEODForCurrentDocument(false)
   , mURIResultedInDocument(false)
   , mIsBeingDestroyed(false)
+  , mScriptGlobalDead(false)
   , mIsExecutingOnLoadHandler(false)
   , mIsPrintingOrPP(false)
   , mSavingOldViewer(false)
@@ -5978,8 +5979,9 @@ nsDocShell::Destroy()
   mParentWidget = nullptr;
   mCurrentURI = nullptr;
 
-  if (mScriptGlobal) {
+  if (mScriptGlobal && !mScriptGlobalDead) {
     mScriptGlobal->DetachFromDocShell();
+    mScriptGlobalDead = true;
   }
 
   if (mSessionHistory) {
@@ -13623,6 +13625,12 @@ NS_IMETHODIMP
 nsDocShell::EnsureScriptEnvironment()
 {
   if (mScriptGlobal) {
+    // If the script global is dead, we may still have it around but we don't
+    // want to expose it from methods such as GetInterface, as their consumers
+    // will expect a non-dead window.
+    if (mScriptGlobalDead) {
+      return NS_ERROR_NOT_AVAILABLE;
+    }
     return NS_OK;
   }
 

docshell/base/nsDocShell.h

@@ -1051,7 +1051,10 @@ protected:
   bool mEODForCurrentDocument : 1;
   bool mURIResultedInDocument : 1;
 
+  // mIsBeingDestroyed is set while the nsDocShell itself is being torn down,
+  // while mScriptGlobalDead is set after mScriptGlobal is torn down.
   bool mIsBeingDestroyed : 1;
+  bool mScriptGlobalDead : 1;
 
   bool mIsExecutingOnLoadHandler : 1;
 

dom/base/nsGlobalWindow.cpp

@@ -3861,7 +3861,7 @@ nsGlobalWindow::ConfirmDialogIfNeeded()
 {
   MOZ_ASSERT(IsOuterWindow());
 
-  NS_ENSURE_TRUE(mDocShell, false);
+  NS_ENSURE_TRUE(!IsCleanedUp(), false);
   nsCOMPtr<nsIPromptService> promptSvc =
     do_GetService("@mozilla.org/embedcomp/prompt-service;1");
 
@@ -4766,6 +4766,12 @@ nsGlobalWindow::GetParentOuter()
 {
   MOZ_RELEASE_ASSERT(IsOuterWindow());
 
+  // If we've been cleaned up, we shouldn't report that we have a parent
+  // anymore.
+  if (mCleanedUp) {
+    return nullptr;
+  }
+
   if (!mDocShell) {
     return nullptr;
   }
@@ -5109,7 +5115,7 @@ nsGlobalWindow::GetClosedOuter()
   MOZ_RELEASE_ASSERT(IsOuterWindow());
 
   // If someone called close(), or if we don't have a docshell, we're closed.
-  return mIsClosed || !mDocShell;
+  return mIsClosed || mCleanedUp;
 }
 
 bool
@@ -5451,6 +5457,12 @@ nsGlobalWindow::GetSanitizedOpener(nsPIDOMWindowOuter* aOpener)
     return nullptr;
   }
 
+  // If we or the opener have been cleaned up we should report a null as our
+  // opener.
+  if (mCleanedUp || win->mCleanedUp) {
+    return nullptr;
+  }
+
   // We don't want to reveal the opener if the opener is a mail window,
   // because opener can be used to spoof the contents of a message (bug 105050).
   // So, we look in the opener's root docshell to see if it's a mail window.
@@ -9380,7 +9392,7 @@ nsGlobalWindow::CloseOuter(bool aTrustedCaller)
 {
   MOZ_RELEASE_ASSERT(IsOuterWindow());
 
-  if (!mDocShell || IsInModalState() ||
+  if (mCleanedUp || !mDocShell || IsInModalState() ||
       (IsFrame() && !mDocShell->GetIsMozBrowser())) {
     // window.close() is called on a frame in a frameset, on a window
     // that's already closed, or on a window for which there's
@@ -9470,7 +9482,7 @@ nsGlobalWindow::ForceClose()
   MOZ_ASSERT(IsOuterWindow());
   MOZ_ASSERT(XRE_GetProcessType() == GeckoProcessType_Default);
 
-  if (IsFrame() || !mDocShell) {
+  if (IsFrame() || mCleanedUp) {
     // This may be a frame in a frameset, or a window that's already closed.
     // Ignore such calls.
     return;