Fixing bug 392532. Infinite recursion crash when getting scroll chrome flags off of a window at the wrong point in time. r+sr=bzbarsky@mit.edu, a=vladimir@pobox.com

docshell/base/nsDocShell.cpp

@@ -304,6 +304,9 @@ nsDocShell::nsDocShell():
     mEditorData(nsnull),
     mTreeOwner(nsnull),
     mChromeEventHandler(nsnull)
+#ifdef DEBUG
+    , mInEnsureScriptEnv(PR_FALSE)
+#endif
 {
     if (gDocShellCount++ == 0) {
         NS_ASSERTION(sURIFixup == nsnull,
@@ -8670,6 +8673,16 @@ nsDocShell::EnsureScriptEnvironment()
         return NS_ERROR_NOT_AVAILABLE;
     }
 
+#ifdef DEBUG
+    NS_ASSERTION(!mInEnsureScriptEnv,
+                 "Infinite loop! Calling EnsureScriptEnvironment() from "
+                 "within EnsureScriptEnvironment()!");
+
+    // Yeah, this isn't re-entrant safe, but that's ok since if we
+    // re-enter this method, we'll infinitely loop...
+    mInEnsureScriptEnv = PR_TRUE;
+#endif
+
     nsCOMPtr<nsIDOMScriptObjectFactory> factory =
         do_GetService(kDOMScriptObjectFactoryCID);
     NS_ENSURE_TRUE(factory, NS_ERROR_FAILURE);
@@ -8700,6 +8713,11 @@ nsDocShell::EnsureScriptEnvironment()
     nsresult rv;
     rv = mScriptGlobal->EnsureScriptEnvironment(nsIProgrammingLanguage::JAVASCRIPT);
     NS_ENSURE_SUCCESS(rv, rv);
+
+#ifdef DEBUG
+    mInEnsureScriptEnv = PR_FALSE;
+#endif
+
     return NS_OK;
 }
 

docshell/base/nsDocShell.h

@@ -651,6 +651,10 @@ protected:
     nsIDocShellTreeOwner *     mTreeOwner; // Weak Reference
     nsPIDOMEventTarget *       mChromeEventHandler; //Weak Reference
 
+#ifdef DEBUG
+    PRBool mInEnsureScriptEnv;
+#endif
+
     static nsIURIFixup *sURIFixup;
 
 

xpfe/appshell/src/nsXULWindow.cpp

@@ -1992,16 +1992,25 @@ void nsXULWindow::SetContentScrollbarVisibility(PRBool aVisible)
 
 PRBool nsXULWindow::GetContentScrollbarVisibility()
 {
-  PRBool visible = PR_TRUE;
+  // This code already exists in dom/src/base/nsBarProp.cpp, but we
+  // can't safely get to that from here as this function is called
+  // while the DOM window is being set up, and we need the DOM window
+  // to get to that code.
+  nsCOMPtr<nsIScrollable> scroller(do_QueryInterface(mPrimaryContentShell));
 
-  nsCOMPtr<nsIDOMWindow> contentWin(do_GetInterface(mPrimaryContentShell));
+  if (scroller) {
-  if (contentWin) {
+    PRInt32 prefValue;
-    nsCOMPtr<nsIDOMBarProp> scrollbars;
+    scroller->GetDefaultScrollbarPreferences(
-    contentWin->GetScrollbars(getter_AddRefs(scrollbars));
+                  nsIScrollable::ScrollOrientation_Y, &prefValue);
-    if (scrollbars)
+    if (prefValue == nsIScrollable::Scrollbar_Never) // try the other way
-      scrollbars->GetVisible(&visible);
+      scroller->GetDefaultScrollbarPreferences(
+                  nsIScrollable::ScrollOrientation_X, &prefValue);
+
+    if (prefValue == nsIScrollable::Scrollbar_Never)
+      return PR_FALSE;
   }
-  return visible;
+
+  return PR_TRUE;
 }
 
 // during spinup, attributes that haven't been loaded yet can't be dirty