Bug 1716444 - Don't do final tab state flush for replaced contexts, r=farre,annyG

If we're destroying the frame loader of a replaced browsing context we'll end up
firing browser-shutdown-tabstate-updated for a tab that wasn't actually closed.

This results in us cleaning up Session Store state earlier than expected, which
means we drop future updates to SessionStoreInternal._closedTabs.

Fixes browser_sessionHistory.js, browser_async_remove_tab.js, and possibly
browser_491168.js for SHIP+BFCache.

Differential Revision: https://phabricator.services.mozilla.com/D117944

browser/components/sessionstore/SessionStore.jsm

@@ -1336,15 +1336,7 @@ var SessionStoreInternal = {
       return;
     }
 
-    // XXX(farre): This could possibly happen for replaced contexts,
-    // both for when aBrowsingContext is itself a top level context
-    // and when it is a sub-frame. This check should really be covered
-    // by the previous epoch check, but we don't currently trust the
-    // epochs to fix that.
-    if (
-      aBrowser.browsingContext &&
-      aBrowser.browsingContext.top != aBrowsingContext.top
-    ) {
+    if (aBrowsingContext.isReplaced) {
       return;
     }
 

docshell/base/CanonicalBrowsingContext.cpp

@@ -224,10 +224,15 @@ void CanonicalBrowsingContext::ReplacedBy(
   MOZ_ASSERT(!aNewContext->mWebProgress);
   MOZ_ASSERT(!aNewContext->mSessionHistory);
   MOZ_ASSERT(IsTop() && aNewContext->IsTop());
+
+  mIsReplaced = true;
+  aNewContext->mIsReplaced = false;
+
   if (mStatusFilter) {
     mStatusFilter->RemoveProgressListener(mDocShellProgressBridge);
     mStatusFilter = nullptr;
   }
+
   mWebProgress->ContextReplaced(aNewContext);
   aNewContext->mWebProgress = std::move(mWebProgress);
 

docshell/base/CanonicalBrowsingContext.h

@@ -325,6 +325,8 @@ class CanonicalBrowsingContext final : public BrowsingContext {
 
   void SetTouchEventsOverride(dom::TouchEventsOverride, ErrorResult& aRv);
 
+  bool IsReplaced() const { return mIsReplaced; }
+
  protected:
   // Called when the browsing context is being discarded.
   void CanonicalDiscard();
@@ -478,6 +480,8 @@ class CanonicalBrowsingContext final : public BrowsingContext {
   bool mPriorityActive = false;
 
   nsCOMPtr<nsITimer> mSessionStoreSessionStorageUpdateTimer;
+
+  bool mIsReplaced = false;
 };
 
 }  // namespace dom

dom/base/nsFrameLoader.cpp

@@ -3239,7 +3239,7 @@ already_AddRefed<Promise> nsFrameLoader::RequestTabStateFlush(
 
 void nsFrameLoader::RequestFinalTabStateFlush() {
   BrowsingContext* context = GetExtantBrowsingContext();
-  if (!context || !context->IsTop()) {
+  if (!context || !context->IsTop() || context->Canonical()->IsReplaced()) {
     return;
   }
 

dom/chrome-webidl/BrowsingContext.webidl

@@ -305,6 +305,8 @@ interface CanonicalBrowsingContext : BrowsingContext {
    * are available in a specific BrowsingContext and its descendents.
    */
   [SetterThrows] inherit attribute TouchEventsOverride touchEventsOverride;
+
+  readonly attribute boolean isReplaced;
 };
 
 [Exposed=Window, ChromeOnly]