Restore some frame recursion protection that got lost. Bug 303163, r+sr=jst

content/base/public/nsIFrameLoader.idl

@@ -41,7 +41,7 @@
 
 interface nsIDocShell;
 
-[scriptable, uuid(eb1a6413-c79f-4189-95b9-7070df9529b1)]
+[scriptable, uuid(88800e93-c6af-4d69-9ee0-29c1100ff431)]
 interface nsIFrameLoader : nsISupports
 {
   /**
@@ -60,6 +60,13 @@ interface nsIFrameLoader : nsISupports
    * clear the weak owner content reference.
    */
   void destroy();
+
+  /**
+   * Find out whether the loader's frame is at too great a depth in
+   * the frame tree.  This can be used to decide what operations may
+   * or may not be allowed on the loader's docshell.
+   */
+  readonly attribute boolean depthTooGreat;
 };
 
 [scriptable, uuid(feaf9285-05ac-4898-a69f-c3bd350767e4)]

content/base/src/nsFrameLoader.cpp

@@ -220,6 +220,13 @@ nsFrameLoader::Destroy()
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsFrameLoader::GetDepthTooGreat(PRBool* aDepthTooGreat)
+{
+  *aDepthTooGreat = mDepthTooGreat;
+  return NS_OK;
+}
+
 nsresult
 nsFrameLoader::EnsureDocShell()
 {
@@ -396,6 +403,8 @@ nsFrameLoader::GetURL(nsString& aURI)
 nsresult
 nsFrameLoader::CheckForRecursiveLoad(nsIURI* aURI)
 {
+  mDepthTooGreat = PR_FALSE;
+  
   NS_PRECONDITION(mDocShell, "Must have docshell here");
   
   nsCOMPtr<nsIDocShellTreeItem> treeItem = do_QueryInterface(mDocShell);
@@ -418,6 +427,7 @@ nsFrameLoader::CheckForRecursiveLoad(nsIURI* aURI)
     ++depth;
     
     if (depth >= MAX_DEPTH_CONTENT_FRAMES) {
+      mDepthTooGreat = PR_TRUE;
       NS_WARNING("Too many nested content frames so giving up");
 
       return NS_ERROR_UNEXPECTED; // Too deep, give up!  (silently?)

content/base/src/nsFrameLoader.h

@@ -49,7 +49,10 @@ class nsIURI;
 class nsFrameLoader : public nsIFrameLoader
 {
 public:
-  nsFrameLoader(nsIContent *aOwner) : mOwnerContent(aOwner) {}
+  nsFrameLoader(nsIContent *aOwner) :
+    mOwnerContent(aOwner),
+    mDepthTooGreat(PR_FALSE)
+  {}
 
   NS_DECL_ISUPPORTS
   NS_DECL_NSIFRAMELOADER
@@ -64,6 +67,7 @@ private:
   nsCOMPtr<nsIDocShell> mDocShell;
 
   nsIContent *mOwnerContent; // WEAK
+  PRBool mDepthTooGreat;
 };
 
 #endif

content/html/content/src/nsGenericHTMLElement.cpp

@@ -3433,6 +3433,13 @@ nsGenericHTMLFrameElement::GetContentWindow(nsIDOMWindow** aContentWindow)
     return NS_OK;
   }
 
+  PRBool depthTooGreat = PR_FALSE;
+  mFrameLoader->GetDepthTooGreat(&depthTooGreat);
+  if (depthTooGreat) {
+    // Claim to have no contentWindow
+    return NS_OK;
+  }
+  
   nsCOMPtr<nsIDocShell> doc_shell;
   mFrameLoader->GetDocShell(getter_AddRefs(doc_shell));