Deal with a dead docshell during document.open. bug 435128, r+sr=jst

content/html/document/src/nsHTMLDocument.cpp

@@ -1785,12 +1785,15 @@ nsHTMLDocument::OpenCommon(const nsACString& aContentType, PRBool aReplace)
 
   // check whether we're in the middle of unload.  If so, ignore this call.
   nsCOMPtr<nsIDocShell> shell = do_QueryReferent(mDocumentContainer);
-  if (shell) {
-    PRBool inUnload;
-    shell->GetIsInUnload(&inUnload);
-    if (inUnload) {
-      return NS_OK;
-    }
+  if (!shell) {
+    // We won't be able to create a parser anyway.
+    return NS_OK;
+  }
+
+  PRBool inUnload;
+  shell->GetIsInUnload(&inUnload);
+  if (inUnload) {
+    return NS_OK;
   }
 
   // Note: We want to use GetDocumentFromContext here because this document
@@ -1846,12 +1849,10 @@ nsHTMLDocument::OpenCommon(const nsACString& aContentType, PRBool aReplace)
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
-  nsCOMPtr<nsIDocShell> docshell = do_QueryReferent(mDocumentContainer);
-
   // Stop current loads targeted at the window this document is in.
-  if (mScriptGlobalObject && docshell) {
+  if (mScriptGlobalObject) {
     nsCOMPtr<nsIContentViewer> cv;
-    docshell->GetContentViewer(getter_AddRefs(cv));
+    shell->GetContentViewer(getter_AddRefs(cv));
 
     if (cv) {
       PRBool okToUnload;
@@ -1864,7 +1865,7 @@ nsHTMLDocument::OpenCommon(const nsACString& aContentType, PRBool aReplace)
       }
     }
 
-    nsCOMPtr<nsIWebNavigation> webnav(do_QueryInterface(docshell));
+    nsCOMPtr<nsIWebNavigation> webnav(do_QueryInterface(shell));
     webnav->Stop(nsIWebNavigation::STOP_NETWORK);
   }
 
@@ -1997,30 +1998,33 @@ nsHTMLDocument::OpenCommon(const nsACString& aContentType, PRBool aReplace)
   if (NS_SUCCEEDED(rv)) {
     nsCOMPtr<nsIHTMLContentSink> sink;
 
-    rv = NS_NewHTMLContentSink(getter_AddRefs(sink), this, uri, docshell,
+    rv = NS_NewHTMLContentSink(getter_AddRefs(sink), this, uri, shell,
                                channel);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_FAILED(rv)) {
+      // Don't use a parser without a content sink.
+      mParser = nsnull;
+      mWriteState = eNotWriting;
+      return rv;
+    }
 
     mParser->SetContentSink(sink);
   }
 
   // Prepare the docshell and the document viewer for the impending
   // out of band document.write()
-  if (docshell) {
-    docshell->PrepareForNewContentModel();
+  shell->PrepareForNewContentModel();
 
-    // Now check whether we were opened with a "replace" argument.  If
-    // so, we need to tell the docshell to not create a new history
-    // entry for this load. Otherwise, make sure that we're doing a normal load,
-    // not whatever type of load was previously done on this docshell.
-    docshell->SetLoadType(aReplace ? LOAD_NORMAL_REPLACE : LOAD_NORMAL);
+  // Now check whether we were opened with a "replace" argument.  If
+  // so, we need to tell the docshell to not create a new history
+  // entry for this load. Otherwise, make sure that we're doing a normal load,
+  // not whatever type of load was previously done on this docshell.
+  shell->SetLoadType(aReplace ? LOAD_NORMAL_REPLACE : LOAD_NORMAL);
 
-    nsCOMPtr<nsIContentViewer> cv;
-    docshell->GetContentViewer(getter_AddRefs(cv));
-    nsCOMPtr<nsIDocumentViewer> docViewer = do_QueryInterface(cv);
-    if (docViewer) {
-      docViewer->LoadStart(static_cast<nsIHTMLDocument *>(this));
-    }
+  nsCOMPtr<nsIContentViewer> cv;
+  shell->GetContentViewer(getter_AddRefs(cv));
+  nsCOMPtr<nsIDocumentViewer> docViewer = do_QueryInterface(cv);
+  if (docViewer) {
+    docViewer->LoadStart(static_cast<nsIHTMLDocument *>(this));
   }
 
   // Add a wyciwyg channel request into the document load group