mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-10-09 19:35:51 +00:00
bd152e0d88
After bug 1582832, DocShell destruction and BrowsingContext detaching happen in separate operations, leaving a gap where a DocShell has been destroyed, but its BrowsingContext is still considered attached. During this gap, the usual invariant that an in-process, attached BrowsingContext always has an associated DOM window doesn't hold, nor do the usual invariants for outer window forwarding security checks. This patch fixes the detach timing so that a child BrowsingContext for a frame which has been removed is always marked detached at the same time its DocShell is destroyed. Co-authored-by: Kris Maglione <maglione.k@gmail.com> Differential Revision: https://phabricator.services.mozilla.com/D62791 --HG-- extra : moz-landing-system : lando |
||
|---|---|---|
| .. | ||
| JSWindowActor | ||
| .eslintrc.js | ||
| blob_verify.sjs | ||
| browser_cancel_content_js.js | ||
| browser_crash_oopiframe.js | ||
| browser_domainPolicy.js | ||
| browser_ElapsedTime.js | ||
| browser_memory_distribution_telemetry.js | ||
| browser.ini | ||
| chrome.ini | ||
| elapsed_time.sjs | ||
| file_bug1086684.html | ||
| file_cancel_content_js.html | ||
| file_disableScript.html | ||
| file_domainPolicy_base.html | ||
| mochitest.ini | ||
| process_error.xhtml | ||
| test_blob_sliced_from_child_process.html | ||
| test_blob_sliced_from_parent_process.html | ||
| test_bug1086684.html | ||
| test_child_docshell.html | ||
| test_cpow_cookies.html | ||
| test_CrashService_crash.html | ||
| test_Preallocated.html | ||
| test_process_error_oom.xhtml | ||
| test_process_error.xhtml | ||
| test_sharedMap.js | ||
| test_temporaryfile_stream.html | ||
| test_window_open_discarded_bc.html | ||
| xpcshell.ini | ||