Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-20 00:35:44 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1656854 - Part 1: Block subframe creation in discarded BCs, r=farre

Browse Source 
This should help catch and/or prevent any cases where we're creating a new
subframe at an unfortunate time during `BrowsingContext` or `WindowContext`
teardown.

Differential Revision: https://phabricator.services.mozilla.com/D85896
This commit is contained in:
Nika Layzell 2020-08-06 14:03:30 +00:00
parent aad2e177d3
commit 28a9513c43
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
docshell/base/BrowsingContext.cpp
View File

@ -584,6 +584,13 @@ void BrowsingContext::Attach(bool aFromIPC, ContentParent* aOriginProcess) {
// Add ourselves either to our parent or BrowsingContextGroup's child list.
if (mParentWindow) {
if (!aFromIPC) {
MOZ_DIAGNOSTIC_ASSERT(!mParentWindow->IsDiscarded(),
"local attach in discarded window");
MOZ_DIAGNOSTIC_ASSERT(!GetParent()->IsDiscarded(),
"local attach call in discarded bc");
}
mParentWindow->AppendChildBrowsingContext(this);
} else {
mGroup->Toplevels().AppendElement(this);

7
dom/base/nsFrameLoader.cpp
View File

@ -2092,6 +2092,13 @@ nsresult nsFrameLoader::MaybeCreateDocShell() {
return NS_ERROR_UNEXPECTED;
}
if (doc->GetWindowContext()->IsDiscarded() ||
parentDocShell->GetBrowsingContext()->IsDiscarded()) {
// Don't allow subframe loads in discarded contexts.
// (see bug 1652085, bug 1656854)
return NS_ERROR_NOT_AVAILABLE;
}
if (!EnsureBrowsingContextAttached()) {
return NS_ERROR_FAILURE;
}