Bug 1554070 - Ensure that the selected window has a targetable BrowsingContext, r=nika

When searching for a target by name, don't select a window if its associated
BrowsingContext is closed, discarded, or cached.

Differential Revision: https://phabricator.services.mozilla.com/D37876

--HG--
extra : moz-landing-system : lando

docshell/base/BrowsingContext.cpp

@@ -383,6 +383,10 @@ void BrowsingContext::RestoreChildren(Children&& aChildren, bool aFromIPC) {
 
 bool BrowsingContext::IsCached() { return mGroup->IsContextCached(this); }
 
+bool BrowsingContext::IsTargetable() {
+  return !mClosed && !mIsDiscarded && !IsCached();
+}
+
 bool BrowsingContext::HasOpener() const {
   return sBrowsingContexts->Contains(mOpenerId);
 }
@@ -526,10 +530,6 @@ bool BrowsingContext::CanAccess(BrowsingContext* aContext) {
   return aContext && nsDocShell::CanAccessItem(aContext->mDocShell, mDocShell);
 }
 
-bool BrowsingContext::IsTargetable() {
-  return !mClosed && !mIsDiscarded && !IsCached();
-}
-
 BrowsingContext::~BrowsingContext() {
   MOZ_DIAGNOSTIC_ASSERT(!mParent || !mParent->mChildren.Contains(this));
   MOZ_DIAGNOSTIC_ASSERT(!mGroup || !mGroup->Toplevels().Contains(this));

docshell/base/BrowsingContext.h

@@ -172,6 +172,10 @@ class BrowsingContext : public nsWrapperCache, public BrowsingContextBase {
   // CacheChildren.
   bool IsCached();
 
+  // Check that this browsing context is targetable for navigations (i.e. that
+  // it is neither closed, cached, nor discarded).
+  bool IsTargetable();
+
   const nsString& Name() const { return mName; }
   void GetName(nsAString& aName) { aName = mName; }
   bool NameEquals(const nsAString& aName) { return mName.Equals(aName); }
@@ -397,10 +401,6 @@ class BrowsingContext : public nsWrapperCache, public BrowsingContextBase {
   // Performs access control to check that 'this' can access 'aContext'.
   bool CanAccess(BrowsingContext* aContext);
 
-  // Check that this browsing context is targetable for navigations (i.e. that
-  // it is neither closed, cached, nor discarded).
-  bool IsTargetable();
-
   // Removes the context from its group and sets mIsDetached to true.
   void Unregister();
 

dom/base/TabGroup.cpp

@@ -224,6 +224,11 @@ nsresult TabGroup::FindItemWithName(const nsAString& aName,
       continue;
     }
 
+    BrowsingContext* bc = outerWindow->GetBrowsingContext();
+    if (!bc || !bc->IsTargetable()) {
+      continue;
+    }
+
     nsCOMPtr<nsIDocShellTreeItem> root;
     docshell->GetSameTypeRootTreeItem(getter_AddRefs(root));
     MOZ_RELEASE_ASSERT(docshell == root);

dom/base/test/browser.ini

@@ -64,3 +64,7 @@ skip-if = (os == "win" && processor == "aarch64") # aarch64 due to bug 1536566
 [browser_multiple_popups.js]
 skip-if = os == 'win' && !debug # Bug 1505235
 support-files = browser_multiple_popups.html
+[browser_bug1554070.js]
+support-files =
+  file_bug1554070_1.html
+  file_bug1554070_2.html

dom/base/test/browser_bug1554070.js

@@ -0,0 +1,47 @@
+"use strict";
+
+const HTTPS_TEST_ROOT = getRootDirectory(gTestPath).replace(
+  "chrome://mochitests/content",
+  "https://example.com"
+);
+
+const URL0 = HTTPS_TEST_ROOT + "file_bug1554070_1.html";
+const URL1 = HTTPS_TEST_ROOT + "file_bug1554070_2.html";
+const URL2 = "https://example.org/";
+
+add_task(async function() {
+  let tab = await BrowserTestUtils.openNewForegroundTab({
+    gBrowser,
+    waitForLoad: true,
+  });
+
+  let browser = tab.linkedBrowser;
+
+  function click() {
+    return ContentTask.spawn(browser, null, () => {
+      let anchor = content.document.querySelector("a");
+      anchor.click();
+    });
+  }
+
+  // Load file_bug1554070_1.html.
+  BrowserTestUtils.loadURI(browser, URL0);
+  await BrowserTestUtils.browserLoaded(browser, false, URL0);
+  is(gBrowser.currentURI.spec, URL0, "loaded file_bug1554070_1.html");
+
+  // Click the link in file_bug1554070_1.html. It should open
+  // file_bug1554070_2.html in the current tab.
+  await click();
+  await BrowserTestUtils.browserLoaded(browser, false, URL1);
+  is(gBrowser.currentURI.spec, URL1, "loaded file_bug1554070_2.html");
+
+  // Click the link in file_bug1554070_2.html. It should open example.org in
+  // a new tab.
+  await click();
+  await BrowserTestUtils.waitForNewTab(gBrowser, URL2, true);
+  is(gBrowser.tabs.length, 3, "got new tab");
+  is(gBrowser.currentURI.spec, URL2, "loaded example.org");
+
+  BrowserTestUtils.removeTab(gBrowser.selectedTab);
+  BrowserTestUtils.removeTab(tab);
+});

dom/base/test/file_bug1554070_1.html

@@ -0,0 +1,14 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1554070
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 1554070</title>
+</head>
+<body>
+  <iframe name="foo"></iframe>
+  <a href="file_bug1554070_2.html">file_bug1554070_2.html</a>
+</body>
+</html>

dom/base/test/file_bug1554070_2.html

@@ -0,0 +1,13 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1554070
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 1554070</title>
+</head>
+<body>
+  <a href="https://example.org" target="foo">example.org</a>
+</body>
+</html>