| author | Ed Morley <emorley@mozilla.com> |
| Thu, 12 Sep 2013 09:29:14 +0100 | |
| changeset 146768 | 749739c77f735172976c1daf9a077af3db60dc01 |
| parent 146767 | 3a27531afc85b22031e1ba6b7febdb9951b75a0b |
| child 146769 | b83f6d80af5fe8fef0a7718eae9741153d4dbfe0 |
| child 146824 | 71b3fa2eb87d128d642e40175a223ab4ea0e514d |
| push id | 25270 |
| push user | emorley@mozilla.com |
| push date | Thu, 12 Sep 2013 11:04:52 +0000 |
| treeherder | mozilla-central@b83f6d80af5f [default view] [failures only] |
| perfherder | [talos] [build metrics] [platform microbench] (compared to previous push) |
| bugs | 914521 |
| milestone | 26.0a1 |
| backs out | cc9df767c70b7007b0243aaf6fd340d8376e4503 |
| first release with | nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
|
| last release without | nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
|
| docshell/base/crashtests/914521.html | file | annotate | diff | comparison | revisions | |
| docshell/base/crashtests/crashtests.list | file | annotate | diff | comparison | revisions | |
| docshell/base/nsDocShell.cpp | file | annotate | diff | comparison | revisions |
deleted file mode 100644 --- a/docshell/base/crashtests/914521.html +++ /dev/null @@ -1,33 +0,0 @@ -<!DOCTYPE html> -<html class="reftest-wait"> -<head> -<meta charset="UTF-8"> -<script> - -function f() -{ - function spin() { - for (var i = 0; i < 8; ++i) { - var x = new XMLHttpRequest(); - x.open('GET', 'data:text/html,' + i, false); - x.send(); - } - } - - window.addEventListener("popstate", spin, false); - window.close(); - window.location = "#c"; - finish(); -} - -function start() -{ - var html = "<script>" + f + "<\/script><body onload=f()>"; - var win = window.open("data:text/html," + encodeURIComponent(html), null, "width=300,height=300"); - win.finish = function() { document.documentElement.removeAttribute("class"); }; -} - -</script> -</head> -<body onload="start();"></body> -</html>
--- a/docshell/base/crashtests/crashtests.list +++ b/docshell/base/crashtests/crashtests.list @@ -6,9 +6,8 @@ load 430628-1.html load 432114-1.html load 432114-2.html asserts-if(Android,2) load 436900-1.html asserts(0-3) load 436900-2.html # bug 566159 load 500328-1.html load 514779-1.xhtml load 614499-1.html load 678872-1.html -pref(dom.disable_open_during_load,false) load 914521.html
--- a/docshell/base/nsDocShell.cpp +++ b/docshell/base/nsDocShell.cpp @@ -9209,33 +9209,28 @@ nsDocShell::InternalLoad(nsIURI * aURI, nsCOMPtr<nsIDocument> doc = do_GetInterface(GetAsSupports(this)); NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE); doc->SetDocumentURI(aURI); SetDocCurrentStateObj(mOSHE); // Dispatch the popstate and hashchange events, as appropriate. - // - // The event dispatch below can cause us to re-enter script and - // destroy the docshell, nulling out mScriptGlobal. Hold a stack - // reference to avoid null derefs. See bug 914521. - nsRefPtr<nsGlobalWindow> win = mScriptGlobal; - if (win) { + if (mScriptGlobal) { // Fire a hashchange event URIs differ, and only in their hashes. bool doHashchange = sameExceptHashes && !curHash.Equals(newHash); if (historyNavBetweenSameDoc || doHashchange) { - win->DispatchSyncPopState(); + mScriptGlobal->DispatchSyncPopState(); } if (doHashchange) { // Make sure to use oldURI here, not mCurrentURI, because by // now, mCurrentURI has changed! - win->DispatchAsyncHashchange(oldURI, aURI); + mScriptGlobal->DispatchAsyncHashchange(oldURI, aURI); } } // Inform the favicon service that the favicon for oldURI also // applies to aURI. CopyFavicon(oldURI, aURI, mInPrivateBrowsing); return NS_OK;