Bug 1798780, ensure we don't evict the current frameloader, r=peterv

Differential Revision: https://phabricator.services.mozilla.com/D163391

docshell/shistory/nsSHistory.cpp

@@ -227,12 +227,22 @@ void nsSHistory::EvictContentViewerForEntry(nsISHEntry* aEntry) {
     viewer->Destroy();
   } else if (nsCOMPtr<SessionHistoryEntry> she = do_QueryInterface(aEntry)) {
     if (RefPtr<nsFrameLoader> frameLoader = she->GetFrameLoader()) {
-      MOZ_LOG(gSHIPBFCacheLog, LogLevel::Debug,
-              ("nsSHistory::EvictContentViewerForEntry "
-               "destroying an nsFrameLoader."));
-      NotifyListenersContentViewerEvicted(1);
-      she->SetFrameLoader(nullptr);
-      frameLoader->Destroy();
+      nsCOMPtr<nsFrameLoaderOwner> owner =
+          do_QueryInterface(frameLoader->GetOwnerContent());
+      RefPtr<nsFrameLoader> currentFrameLoader;
+      if (owner) {
+        currentFrameLoader = owner->GetFrameLoader();
+      }
+
+      // Only destroy non-current frameloader when evicting from the bfcache.
+      if (currentFrameLoader != frameLoader) {
+        MOZ_LOG(gSHIPBFCacheLog, LogLevel::Debug,
+                ("nsSHistory::EvictContentViewerForEntry "
+                 "destroying an nsFrameLoader."));
+        NotifyListenersContentViewerEvicted(1);
+        she->SetFrameLoader(nullptr);
+        frameLoader->Destroy();
+      }
     }
   }
 
@@ -1296,6 +1306,11 @@ static void FinishRestore(CanonicalBrowsingContext* aBrowsingContext,
     // disabled everywhere.
 
     frameLoaderOwner->RestoreFrameLoaderFromBFCache(aFrameLoader);
+    // EvictOutOfRangeContentViewers is called here explicitly to
+    // possibly evict the now in the bfcache document.
+    // HistoryCommitIndexAndLength might not have evicted that before the
+    // FrameLoader swap.
+    shistory->EvictOutOfRangeContentViewers(indexOfHistoryLoad);
 
     // The old page can't be stored in the bfcache,
     // destroy the nsFrameLoader.

docshell/test/browser/browser.ini

@@ -112,6 +112,7 @@ skip-if = !fission || !crashreporter # On a crash we only keep history when fiss
 [browser_bug1719178.js]
 [browser_bug1757005.js]
 [browser_bug1769189.js]
+[browser_bug1798780.js]
 [browser_bug234628-1.js]
 [browser_bug234628-10.js]
 [browser_bug234628-11.js]

docshell/test/browser/browser_bug1798780.js

@@ -0,0 +1,51 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+// The test loads an initial page and then another page which does enough
+// fragment navigations so that when going back to the initial page and then
+// forward to the last page, the initial page is evicted from the bfcache.
+add_task(async function testBFCacheEviction() {
+  // Make an unrealistic large timeout.
+  await SpecialPowers.pushPrefEnv({
+    set: [["browser.sessionhistory.contentViewerTimeout", 86400]],
+  });
+
+  const uri = "data:text/html,initial page";
+  const uri2 =
+    getRootDirectory(gTestPath).replace(
+      "chrome://mochitests/content",
+      "https://example.com"
+    ) + "dummy_page.html";
+
+  await BrowserTestUtils.withNewTab({ gBrowser, url: uri }, async function(
+    browser
+  ) {
+    BrowserTestUtils.loadURI(browser, uri2);
+    await BrowserTestUtils.browserLoaded(browser);
+
+    let awaitPageShow = BrowserTestUtils.waitForContentEvent(
+      browser,
+      "pageshow"
+    );
+    await SpecialPowers.spawn(browser, [], async function() {
+      content.location.hash = "1";
+      content.location.hash = "2";
+      content.location.hash = "3";
+      content.history.go(-4);
+    });
+
+    await awaitPageShow;
+
+    let awaitPageShow2 = BrowserTestUtils.waitForContentEvent(
+      browser,
+      "pageshow"
+    );
+    await SpecialPowers.spawn(browser, [], async function() {
+      content.history.go(4);
+    });
+    await awaitPageShow2;
+    ok(true, "Didn't time out.");
+  });
+});