From 574f798fb385f4a598fcd190db8ca2f34463213e Mon Sep 17 00:00:00 2001
From: Olli Pettay <Olli.Pettay@helsinki.fi>
Date: Mon, 28 Oct 2019 21:08:50 +0000
Subject: [PATCH] Bug 1586750, don't compile event handlers on unloaded windows
 r=peterv

Differential Revision: https://phabricator.services.mozilla.com/D48983

--HG--
extra : moz-landing-system : lando
---
 dom/base/nsGlobalWindowOuter.cpp    |  2 ++
 dom/events/EventListenerManager.cpp | 22 +++++++++-------------
 dom/events/test/mochitest.ini       |  1 -
 dom/events/test/test_bug812744.html |  3 +--
 4 files changed, 12 insertions(+), 16 deletions(-)

diff --git a/dom/base/nsGlobalWindowOuter.cpp b/dom/base/nsGlobalWindowOuter.cpp
index 764023e23182..aae09fc7491b 100644
--- a/dom/base/nsGlobalWindowOuter.cpp
+++ b/dom/base/nsGlobalWindowOuter.cpp
@@ -1474,6 +1474,8 @@ nsresult nsGlobalWindowOuter::EnsureScriptEnvironment() {
     return NS_OK;
   }
 
+  NS_ENSURE_STATE(!mCleanedUp);
+
   NS_ASSERTION(!GetCurrentInnerWindowInternal(),
                "No cached wrapper, but we have an inner window?");
   NS_ASSERTION(!mContext, "Will overwrite mContext!");
diff --git a/dom/events/EventListenerManager.cpp b/dom/events/EventListenerManager.cpp
index 315a0bab192f..b6e396366e3f 100644
--- a/dom/events/EventListenerManager.cpp
+++ b/dom/events/EventListenerManager.cpp
@@ -1717,29 +1717,25 @@ already_AddRefed<nsIScriptGlobalObject>
 EventListenerManager::GetScriptGlobalAndDocument(Document** aDoc) {
   nsCOMPtr<nsINode> node(do_QueryInterface(mTarget));
   nsCOMPtr<Document> doc;
-  nsCOMPtr<nsIScriptGlobalObject> global;
+  nsCOMPtr<nsPIDOMWindowInner> win;
   if (node) {
     // Try to get context from doc
-    // XXX sXBL/XBL2 issue -- do we really want the owner here?  What
-    // if that's the XBL document?
     doc = node->OwnerDoc();
     if (doc->IsLoadedAsData()) {
       return nullptr;
     }
 
-    // We want to allow compiling an event handler even in an unloaded
-    // document, so use GetScopeObject here, not GetScriptHandlingObject.
-    global = do_QueryInterface(doc->GetScopeObject());
-  } else {
-    if (nsCOMPtr<nsPIDOMWindowInner> win = GetTargetAsInnerWindow()) {
-      doc = win->GetExtantDoc();
-      global = do_QueryInterface(win);
-    } else {
-      global = do_QueryInterface(mTarget);
-    }
+    win = do_QueryInterface(doc->GetScopeObject());
+  } else if ((win = GetTargetAsInnerWindow())) {
+    doc = win->GetExtantDoc();
+  }
+
+  if (!win || !win->IsCurrentInnerWindow()) {
+    return nullptr;
   }
 
   doc.forget(aDoc);
+  nsCOMPtr<nsIScriptGlobalObject> global = do_QueryInterface(win);
   return global.forget();
 }
 
diff --git a/dom/events/test/mochitest.ini b/dom/events/test/mochitest.ini
index 70542b3475fc..e260c7cc2d8a 100644
--- a/dom/events/test/mochitest.ini
+++ b/dom/events/test/mochitest.ini
@@ -123,7 +123,6 @@ skip-if = toolkit == 'android' #CRASH_DUMP, RANDOM
 [test_bug741666.html]
 [test_deviceSensor.html]
 [test_bug812744.html]
-skip-if = fission && debug # Failed assertion: No cached wrapper, but we have an inner window?: '!GetCurrentInnerWindowInternal()', file /builds/worker/workspace/build/src/dom/base/nsGlobalWindowOuter.cpp, line 1474
 [test_bug822898.html]
 [test_bug855741.html]
 [test_bug864040.html]
diff --git a/dom/events/test/test_bug812744.html b/dom/events/test/test_bug812744.html
index 8bdf59462626..2cd677b930a5 100644
--- a/dom/events/test/test_bug812744.html
+++ b/dom/events/test/test_bug812744.html
@@ -26,8 +26,7 @@ addLoadEvent(function() {
   var el = f.contentDocument.documentElement;
   f.onload = function() {
     el.setAttribute("onmouseleave", "(void 0)");
-    is(el.onmouseleave.toString(), "function onmouseleave(event) {\n(void 0)\n}",
-       "Should have a function here");
+    is(el.onmouseleave, null, "Should not have a function here");
     SimpleTest.finish();
   };
   f.src = "http://www.example.com/"