Bug 1595925 - QI to nsIWebNavigation before using docShell.document, r=bgrins
authorGijs Kruitbosch <gijskruitbosch@gmail.com>
Mon, 18 Nov 2019 17:59:36 +0000
changeset 502446 9cd05214d12a8727677c0db1fe46a73ca51f70b8
parent 502445 7a519d43db7f8cfded9f05d388926fffcb8146a2
child 502447 90678a02990b0a6e81066a5c790d0b60a6a792d2
push id114172
push userdluca@mozilla.com
push dateTue, 19 Nov 2019 11:31:10 +0000
treeherdermozilla-inbound@b5c5ba07d3db [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbgrins
bugs1595925
milestone72.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1595925 - QI to nsIWebNavigation before using docShell.document, r=bgrins Differential Revision: https://phabricator.services.mozilla.com/D53661
browser/base/content/tabbrowser.js
toolkit/content/browser-child.js
--- a/browser/base/content/tabbrowser.js
+++ b/browser/base/content/tabbrowser.js
@@ -5244,17 +5244,22 @@
         }
 
         let browser = contentWin.docShell.chromeEventHandler;
         var tab = this.getTabForBrowser(browser);
         if (!tab || tab.hasAttribute("pending")) {
           return;
         }
 
-        if (!browser.docShell || event.target != browser.docShell.document) {
+        if (!browser.docShell) {
+          return;
+        }
+        // Ensure `docShell.document` (an nsIWebNavigation idl prop) is there:
+        browser.docShell.QueryInterface(Ci.nsIWebNavigation);
+        if (event.target != browser.docShell.document) {
           return;
         }
 
         // Ignore empty title changes on internal pages. This prevents the title
         // from changing while Fluent is populating the (initially-empty) title
         // element.
         if (
           !browser.contentTitle &&
--- a/toolkit/content/browser-child.js
+++ b/toolkit/content/browser-child.js
@@ -28,17 +28,23 @@ sendAsyncMessage("Content:BrowserChildRe
 
 addEventListener(
   "DOMTitleChanged",
   function(aEvent) {
     if (
       !aEvent.isTrusted ||
       // Check that we haven't been closed (DOM code dispatches this event
       // asynchronously).
-      content.closed ||
+      content.closed
+    ) {
+      return;
+    }
+    // Ensure `docShell.document` (an nsIWebNavigation idl prop) is there:
+    docShell.QueryInterface(Ci.nsIWebNavigation);
+    if (
       // Check that the document whose title changed is the toplevel document,
       // rather than a subframe, and check that it is still the current
       // document in the docshell - we may have started loading another one.
       docShell.document != aEvent.target
     ) {
       return;
     }
     sendAsyncMessage("DOMTitleChanged", { title: content.document.title });