Bug 610571 - Leak with crazy iframe testcase, r=bz, a=blocking

2011-01-15 16:41:06 +02:00 · 2011-01-15 16:41:06 +02:00 · c756238e01
--- a/content/base/crashtests/610571-1.html
+++ b/content/base/crashtests/610571-1.html
@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+  var frame1 = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); frame1.src = "data:text/html,1"; document.body.appendChild(frame1);
+  var frame2 = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); frame2.src = "data:text/html,2"; document.body.appendChild(frame2);
+  var frame1doc = frame1.contentDocument;
+  var frame1root = frame1doc.documentElement;
+  frame1root.appendChild(frame2);
+  setTimeout(function() { 
+    try {
+      frame2.contentDocument.q = frame1root.__lookupGetter__("nextSibling");
+    } catch(ex) {}
+    document.documentElement.removeAttribute("class");
+  }, 200);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
+
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@ -82,3 +82,4 @@ load 595606-2.html
 load 606729-1.html
 load 593302-1.html
 load 593302-2.html
+load 610571-1.html
--- a/content/base/src/nsFrameLoader.cpp
+++ b/content/base/src/nsFrameLoader.cpp
@ -1386,8 +1386,9 @@ nsFrameLoader::MaybeCreateDocShell()
    return NS_ERROR_UNEXPECTED;
  }

-  if (doc->GetDisplayDocument()) {
-    // Don't allow subframe loads in external reference documents
+  if (doc->GetDisplayDocument() || !doc->IsActive()) {
+    // Don't allow subframe loads in external reference documents, nor
+    // in non-active documents.
    return NS_ERROR_NOT_AVAILABLE;
  }