From 8baec9cd7490c8c2bf772c13352e55e1f501f28c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Paul=20O=E2=80=99Shannessy?= <paul@oshannessy.com>
Date: Fri, 25 May 2012 10:43:19 +0200
Subject: [PATCH] Bug 739531 - Can't duplicate a tab with designMode and no
 body; r=ttaubert

---
 .../sessionstore/src/nsSessionStore.js        |  7 +--
 .../components/sessionstore/test/Makefile.in  |  2 +
 .../sessionstore/test/browser_739531.js       | 47 +++++++++++++++++++
 .../test/browser_739531_sample.html           | 24 ++++++++++
 4 files changed, 77 insertions(+), 3 deletions(-)
 create mode 100644 browser/components/sessionstore/test/browser_739531.js
 create mode 100644 browser/components/sessionstore/test/browser_739531_sample.html

diff --git a/browser/components/sessionstore/src/nsSessionStore.js b/browser/components/sessionstore/src/nsSessionStore.js
index 480cb960fc9..267451f2151 100644
--- a/browser/components/sessionstore/src/nsSessionStore.js
+++ b/browser/components/sessionstore/src/nsSessionStore.js
@@ -2228,9 +2228,9 @@ SessionStoreService.prototype = {
           delete aData.formdata;
         }
       }
-      
+
       // designMode is undefined e.g. for XUL documents (as about:config)
-      if ((aContent.document.designMode || "") == "on") {
+      if ((aContent.document.designMode || "") == "on" && aContent.document.body) {
         if (aData.innerHTML === undefined && !aFullData) {
           // we get no "input" events from iframes - listen for keypress here
           let _this = this;
@@ -3412,7 +3412,8 @@ SessionStoreService.prototype = {
       if (aData.innerHTML) {
         aWindow.setTimeout(function() {
           if (aContent.document.designMode == "on" &&
-              hasExpectedURL(aContent.document, aData.url)) {
+              hasExpectedURL(aContent.document, aData.url) &&
+              aContent.document.body) {
             aContent.document.body.innerHTML = aData.innerHTML;
           }
         }, 0);
diff --git a/browser/components/sessionstore/test/Makefile.in b/browser/components/sessionstore/test/Makefile.in
index 8d9ba6dd59e..3e2b8f7c064 100644
--- a/browser/components/sessionstore/test/Makefile.in
+++ b/browser/components/sessionstore/test/Makefile.in
@@ -132,6 +132,8 @@ _BROWSER_TEST_FILES = \
 	browser_701377.js \
 	browser_705597.js \
 	browser_707862.js \
+	browser_739531.js \
+	browser_739531_sample.html \
 	browser_739805.js \
 	$(NULL)
 
diff --git a/browser/components/sessionstore/test/browser_739531.js b/browser/components/sessionstore/test/browser_739531.js
new file mode 100644
index 00000000000..e5927caf654
--- /dev/null
+++ b/browser/components/sessionstore/test/browser_739531.js
@@ -0,0 +1,47 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+// This test ensures that attempts made to save/restore ("duplicate") pages
+// using designmode AND make changes to document structure (remove body)
+// don't result in uncaught errors and a broken browser state.
+
+function test() {
+  waitForExplicitFinish();
+
+  let testURL = "http://mochi.test:8888/browser/" +
+    "browser/components/sessionstore/test/browser_739531_sample.html";
+
+  let loadCount = 0;
+  let tab = gBrowser.addTab(testURL);
+  tab.linkedBrowser.addEventListener("load", function onLoad(aEvent) {
+    // make sure both the page and the frame are loaded
+    if (++loadCount < 2)
+      return;
+    tab.linkedBrowser.removeEventListener("load", onLoad, true);
+
+    // executeSoon to allow the JS to execute on the page
+    executeSoon(function() {
+
+      let tab2;
+      let caughtError = false;
+      try {
+        tab2 = ss.duplicateTab(window, tab);
+      }
+      catch (e) {
+        caughtError = true;
+        info(e);
+      }
+
+      is(gBrowser.tabs.length, 3, "there should be 3 tabs")
+
+      ok(!caughtError, "duplicateTab didn't throw");
+
+      // if the test fails, we don't want to try to close a tab that doesn't exist
+      if (tab2)
+        gBrowser.removeTab(tab2);
+      gBrowser.removeTab(tab);
+
+      finish();
+    });
+  }, true);
+}
diff --git a/browser/components/sessionstore/test/browser_739531_sample.html b/browser/components/sessionstore/test/browser_739531_sample.html
new file mode 100644
index 00000000000..49c1e7ded61
--- /dev/null
+++ b/browser/components/sessionstore/test/browser_739531_sample.html
@@ -0,0 +1,24 @@
+<!-- originally a crash test for bug 713417
+     https://bug713417.bugzilla.mozilla.org/attachment.cgi?id=584240 -->
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var w = document.getElementById("f").contentWindow;
+  var d = w.document;
+  d.designMode = 'on';
+  var r = d.documentElement;
+  d.removeChild(r);
+  document.adoptNode(r);
+}
+
+</script>
+</head>
+<body onload="boom();">
+<iframe src="data:text/html,1" id="f"></iframe>
+</body>
+</html>
+