Bug 1432396 - Bail out if the docshell is being destroyed due to pagehide notification. r=bz

There are four call sites of FirePageHideNotification().  Two of them are
handled in this patch.  The other two will be taken care of in the subsequent
patches in this patch series respectively.

Without this fix, the test case in this patch causes assertions when
cycle collection happens.

MozReview-Commit-ID: 6GSxjdfXGcY

--HG--
extra : rebase_source : 998b95ae90a1ad80dc177d5eecf1a592ba375116
This commit is contained in:
Hiroyuki Ikezoe 2018-02-16 06:15:03 +09:00
Родитель a337532619
Коммит cb1555c1b4
5 изменённых файлов: 45 добавлений и 0 удалений

Просмотреть файл

@ -7720,6 +7720,10 @@ nsDocShell::CreateAboutBlankContentViewer(nsIPrincipal* aPrincipal,
// wrong information :-(
//
(void)FirePageHideNotification(!mSavingOldViewer);
// pagehide notification might destroy this docshell.
if (mIsBeingDestroyed) {
return NS_ERROR_DOCSHELL_DYING;
}
}
// Now make sure we don't think we're in the middle of firing unload after
@ -8251,6 +8255,10 @@ nsDocShell::RestoreFromHistory()
// Notify the old content viewer that it's being hidden.
FirePageHideNotification(!mSavingOldViewer);
// pagehide notification might destroy this docshell.
if (mIsBeingDestroyed) {
return NS_ERROR_DOCSHELL_DYING;
}
// If mLSHE was changed as a result of the pagehide event, then
// something else was loaded. Don't finish restoring.

Просмотреть файл

@ -0,0 +1,5 @@
<script>
window.onload = () => {
opener.postMessage("initial", "*");
}
</script>

Просмотреть файл

@ -0,0 +1,5 @@
<script>
window.onload = () => {
opener.postMessage("second", "*");
}
</script>;

Просмотреть файл

@ -46,6 +46,8 @@ support-files =
file_bug1121701_2.html
file_bug1186774.html
file_bug1151421.html
file_close_onpagehide1.html
file_close_onpagehide2.html
file_pushState_after_document_open.html
historyframes.html
start_historyframe.html
@ -104,6 +106,7 @@ support-files = file_bug675587.html
[test_bug1121701.html]
[test_bug1151421.html]
[test_bug1186774.html]
[test_close_onpagehide_by_history_back.html]
[test_forceinheritprincipal_overrule_owner.html]
[test_framedhistoryframes.html]
skip-if = toolkit == 'android' # bug 784321

Просмотреть файл

@ -0,0 +1,24 @@
<!doctype html>
<title>Test for closing window in pagehide event callback caused by history.back()</title>
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1432396">Mozilla Bug 1432396</a>
<p id="display"></p>
<script>
SimpleTest.waitForExplicitFinish();
const w = window.open("file_close_onpagehide1.html");
window.addEventListener("message", e => {
is(e.data, "initial", "The initial page loaded");
window.addEventListener("message", e => {
is(e.data, "second", "The second page loaded");
w.onpagehide = () => {
w.close();
info("try to close the popped up window in onpagehide");
SimpleTest.finish();
};
w.history.back();
}, { once: true });
w.location = "file_close_onpagehide2.html";
}, { once: true });
</script>