Bug 1378281 - Check IPCOpen and abort if the TabChild has been destroyed, r=smaug
authorMichael Layzell <michael@thelayzells.com>
Wed, 12 Jul 2017 10:20:13 -0400
changeset 607739 703825995ef40591a932983f7a812c335f50ec75
parent 607738 8fe427b20f9074c88387cacd01c55b2e06c96394
child 607740 61c6ddbcf8a9cb92dd19622507865a2001982677
push id68095
push userbmo:rbarker@mozilla.com
push dateWed, 12 Jul 2017 20:01:47 +0000
reviewerssmaug
bugs1378281
milestone56.0a1
Bug 1378281 - Check IPCOpen and abort if the TabChild has been destroyed, r=smaug MozReview-Commit-ID: ECTVHnGF8UI
dom/ipc/ContentChild.cpp
--- a/dom/ipc/ContentChild.cpp
+++ b/dom/ipc/ContentChild.cpp
@@ -998,16 +998,21 @@ ContentChild::ProvideWindowCommon(TabChi
     return rv;
   }
 
   if (!*aWindowIsNew) {
     PRenderFrameChild::Send__delete__(renderFrame);
     return NS_ERROR_ABORT;
   }
 
+  // If the TabChild has been torn down, we don't need to do this anymore.
+  if (NS_WARN_IF(!newChild->IPCOpen())) {
+    return NS_ERROR_ABORT;
+  }
+
   if (layersId == 0) { // if renderFrame is invalid.
     PRenderFrameChild::Send__delete__(renderFrame);
     renderFrame = nullptr;
   }
 
   ShowInfo showInfo(EmptyString(), false, false, true, false, 0, 0, 0);
   auto* opener = nsPIDOMWindowOuter::From(aParent);
   nsIDocShell* openerShell;