From e468f5e83ad01f8a8801e8fd8ebe6becbbe60c21 Mon Sep 17 00:00:00 2001
From: Andrew McCreight <continuation@gmail.com>
Date: Mon, 15 Feb 2021 16:52:26 +0000
Subject: [PATCH] Bug 1672873 - Use BuildClonedMessageDataForChild to send
 cloneable data in SessionHistoryInfo. r=peterv

The serialization method for SessionHistoryInfo uses some low-level
functions to pack up some of the clone data, but this method
actually has a PContent actor available, so it can use one of the
nicer BuildClonedMessageDataFor methods to send this, which
should improve support for pushMessage with blobs.

The read method already uses the StealFromClonedMessageDataFor
methods so no changes are required there.

Differential Revision: https://phabricator.services.mozilla.com/D104775
---
 docshell/base/crashtests/1672873.html     |  6 ++++++
 docshell/base/crashtests/crashtests.list  |  1 +
 docshell/shistory/SessionHistoryEntry.cpp | 25 +++++++++++++++--------
 3 files changed, 23 insertions(+), 9 deletions(-)
 create mode 100644 docshell/base/crashtests/1672873.html

diff --git a/docshell/base/crashtests/1672873.html b/docshell/base/crashtests/1672873.html
new file mode 100644
index 000000000000..33aa92f0ef2b
--- /dev/null
+++ b/docshell/base/crashtests/1672873.html
@@ -0,0 +1,6 @@
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+  var x = new Blob([undefined, ''], { })
+  self.history.pushState(x, 'x', 'missing.file')
+})
+</script>
diff --git a/docshell/base/crashtests/crashtests.list b/docshell/base/crashtests/crashtests.list
index 3912fe5081fc..bf58c598b3cd 100644
--- a/docshell/base/crashtests/crashtests.list
+++ b/docshell/base/crashtests/crashtests.list
@@ -19,3 +19,4 @@ load 1584467.html
 load 1614211-1.html
 load 1617315-1.html
 skip-if(Android) pref(dom.disable_open_during_load,false) load 1667491.html
+load 1672873.html
diff --git a/docshell/shistory/SessionHistoryEntry.cpp b/docshell/shistory/SessionHistoryEntry.cpp
index 9e8703fa04b5..2d44a9f1e135 100644
--- a/docshell/shistory/SessionHistoryEntry.cpp
+++ b/docshell/shistory/SessionHistoryEntry.cpp
@@ -15,6 +15,8 @@
 #include "nsXULAppAPI.h"
 #include "mozilla/PresState.h"
 #include "mozilla/Tuple.h"
+#include "mozilla/dom/ContentChild.h"
+#include "mozilla/dom/ContentParent.h"
 #include "mozilla/dom/CSPMessageUtils.h"
 #include "mozilla/dom/DOMTypes.h"
 #include "mozilla/dom/nsCSPContext.h"
@@ -1353,16 +1355,21 @@ void IPDLParamTraits<dom::SessionHistoryInfo>::Write(
     NS_ENSURE_SUCCESS_VOID(aParam.mStateData->GetFormatVersion(&version));
     Get<0>(*stateData) = version;
 
-    JSStructuredCloneData& data = aParam.mStateData->Data();
-    auto iter = data.Start();
-    bool success;
-    Get<1>(*stateData).data().data = data.Borrow(iter, data.Size(), &success);
-    if (NS_WARN_IF(!success)) {
-      return;
+    IToplevelProtocol* topLevel = aActor->ToplevelProtocol();
+    MOZ_RELEASE_ASSERT(topLevel->GetProtocolId() == PContentMsgStart);
+    if (topLevel->GetSide() == ChildSide) {
+      auto* contentChild = static_cast<dom::ContentChild*>(topLevel);
+      if (NS_WARN_IF(!aParam.mStateData->BuildClonedMessageDataForChild(
+              contentChild, Get<1>(*stateData)))) {
+        return;
+      }
+    } else {
+      auto* contentParent = static_cast<dom::ContentParent*>(topLevel);
+      if (NS_WARN_IF(!aParam.mStateData->BuildClonedMessageDataForParent(
+              contentParent, Get<1>(*stateData)))) {
+        return;
+      }
     }
-    MOZ_ASSERT(aParam.mStateData->PortIdentifiers().IsEmpty() &&
-               aParam.mStateData->BlobImpls().IsEmpty() &&
-               aParam.mStateData->InputStreams().IsEmpty());
   }
 
   WriteIPDLParam(aMsg, aActor, aParam.mURI);