Fixing bug 194994. Make sure hidden iframes' die when leaving the page. r=bugmail@sicking.cc, sr=peterv@netscape.com, a=asa@mozilla.org

content/base/src/nsFrameLoader.cpp

@@ -234,8 +234,13 @@ nsFrameLoader::GetDocShell(nsIDocShell **aDocShell)
 {
   *aDocShell = nsnull;
 
-  nsresult rv = EnsureDocShell();
-  NS_ENSURE_SUCCESS(rv, rv);
+  // If we have an owner, make sure we have a docshell and return
+  // that. If not, we're most likely in the middle of being torn down,
+  // then we just return null.
+  if (mOwnerContent) {
+    nsresult rv = EnsureDocShell();
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
 
   *aDocShell = mDocShell;
   NS_IF_ADDREF(*aDocShell);

content/html/content/src/nsHTMLIFrameElement.cpp

@@ -357,10 +357,20 @@ nsHTMLIFrameElement::SetDocument(nsIDocument *aDocument, PRBool aDeep,
                                                aCompileEventHandlers);
   NS_ENSURE_SUCCESS(rv, rv);
 
+  if (!aDocument && mFrameLoader) {
+    // This iframe is being taken out of the document, destroy the
+    // iframe's frame loader (doing that will tear down the window in
+    // this iframe).
+
+    mFrameLoader->Destroy();
+
+    mFrameLoader = nsnull;
+  }
+
   // When document is being set to null on the element's destruction,
   // or when the document is being set to what the document already
   // is, do not call LoadSrc().
-  if (!mParent || !mDocument || aDocument == old_doc) {
+  if (!mParent || !aDocument || aDocument == old_doc) {
     return NS_OK;
   }