Bug 1450164 - Don't update URIs on history adds on docshells that are being shut down; r=bzbarsky

If we add to history on a docshell that is being shut down, add
history entry but skip trying to load the new URI.

MozReview-Commit-ID: JCF9muhxbFd

Differential Revision: https://phabricator.services.mozilla.com/D2311

--HG--
extra : moz-landing-system : lando
This commit is contained in:
Kyle Machulis 2018-08-02 00:51:09 +00:00
parent 0ce3ff104d
commit e8ad4d6c8a
4 changed files with 53 additions and 1 deletions

View File

@ -11751,7 +11751,10 @@ nsDocShell::AddState(JS::Handle<JS::Value> aData, const nsAString& aTitle,
// notification is allowed only when we know docshell is not loading a new
// document and it requires LOCATION_CHANGE_SAME_DOCUMENT flag. Otherwise,
// FireOnLocationChange(...) breaks security UI.
if (!equalURIs) {
//
// If the docshell is shutting down, don't update the document URI, as we
// can't load into a docshell that is being destroyed.
if (!equalURIs && !mIsBeingDestroyed) {
document->SetDocumentURI(newURI);
// We can't trust SetCurrentURI to do always fire locationchange events
// when we expect it to, so we hack around that by doing it ourselves...

View File

@ -0,0 +1,16 @@
<html>
<head>
<script>
function go() {
var a = window.history.state;
window.history.replaceState(a,"","1");
var ok = opener.ok;
var SimpleTest = opener.SimpleTest;
ok("Addition of history in unload did not crash browser");
SimpleTest.finish();
}
</script>
</head>
<body onunload="go()">
</body>
</html>

View File

@ -43,6 +43,7 @@ support-files =
file_bug1121701_2.html
file_bug1186774.html
file_bug1151421.html
file_bug1450164.html
file_close_onpagehide1.html
file_close_onpagehide2.html
file_pushState_after_document_open.html
@ -104,6 +105,7 @@ support-files = file_bug675587.html
[test_bug1121701.html]
[test_bug1151421.html]
[test_bug1186774.html]
[test_bug1450164.html]
[test_close_onpagehide_by_history_back.html]
[test_close_onpagehide_by_window_close.html]
[test_forceinheritprincipal_overrule_owner.html]

View File

@ -0,0 +1,31 @@
<!DOCTYPE HTML>
<html>
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=1450164
-->
<head>
<meta charset="utf-8">
<title>Test for Bug 1450164</title>
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
<script type="application/javascript">
/** Test for Bug 1450164 **/
function runTest() {
child = window.open("file_bug1450164.html", "", "width=100,height=100");
child.onload = function() {
// After the window loads, close it. If we don't crash in debug, consider that a pass.
child.close();
}
}
SimpleTest.waitForExplicitFinish();
addLoadEvent(runTest);
</script>
</head>
<body>
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1450164">Mozilla Bug 1450164</a>
</body>
</html>