wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 914521 - Hold a stack reference to mScriptGlobal when dispatching sync events. r=bz

Browse Source 
Note also MMAdeathGrip earlier in the function.
This commit is contained in:
Bobby Holley 2013-09-12 11:18:25 -07:00
parent b9f8166806
commit 14395007cd
3 changed files with 42 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
docshell/base/crashtests/914521.html Normal file
View File

@ -0,0 +1,33 @@
<!DOCTYPE html>
<html class="reftest-wait">
<head>
<meta charset="UTF-8">
<script>
function f()
{
function spin() {
for (var i = 0; i < 8; ++i) {
var x = new XMLHttpRequest();
x.open('GET', 'data:text/html,' + i, false);
x.send();
}
}
window.addEventListener("popstate", spin, false);
window.close();
window.location = "#c";
finish();
}
function start()
{
var html = "<script>" + f + "<\/script><body onload=f()>";
var win = window.open("data:text/html," + encodeURIComponent(html), null, "width=300,height=300");
win.finish = function() { document.documentElement.removeAttribute("class"); };
}
</script>
</head>
<body onload="start();"></body>
</html>

1
docshell/base/crashtests/crashtests.list
View File

@ -11,3 +11,4 @@ load 500328-1.html
load 514779-1.xhtml
load 614499-1.html
load 678872-1.html
skip-if(Android||B2G) pref(dom.disable_open_during_load,false) load 914521.html

11
docshell/base/nsDocShell.cpp
View File

@ -9214,18 +9214,23 @@ nsDocShell::InternalLoad(nsIURI * aURI,
SetDocCurrentStateObj(mOSHE);
// Dispatch the popstate and hashchange events, as appropriate.
if (mScriptGlobal) {
//
// The event dispatch below can cause us to re-enter script and
// destroy the docshell, nulling out mScriptGlobal. Hold a stack
// reference to avoid null derefs. See bug 914521.
nsRefPtr<nsGlobalWindow> win = mScriptGlobal;
if (win) {
// Fire a hashchange event URIs differ, and only in their hashes.
bool doHashchange = sameExceptHashes && !curHash.Equals(newHash);
if (historyNavBetweenSameDoc || doHashchange) {
mScriptGlobal->DispatchSyncPopState();
win->DispatchSyncPopState();
}
if (doHashchange) {
// Make sure to use oldURI here, not mCurrentURI, because by
// now, mCurrentURI has changed!
mScriptGlobal->DispatchAsyncHashchange(oldURI, aURI);
win->DispatchAsyncHashchange(oldURI, aURI);
}
}