Bug 693399 - r=bzbarsky, backport=dveditz, a=dveditz
authorHenri Sivonen <hsivonen@iki.fi>
Mon, 23 Jan 2012 16:52:33 -0800
changeset 35246 e04e018f9ae69c5dc383cbd823a6aa694b6472d4
parent 35245 952491790deeed5144d1976ae3a393a98d6d0288
child 35247 173bc943fe0d1dc8f7d9e6d0f293711efa26fa93
push id2012
push userdveditz@mozilla.com
push dateTue, 24 Jan 2012 00:53:47 +0000
reviewersbzbarsky, dveditz
bugs693399
milestone1.9.2.26pre
Bug 693399 - r=bzbarsky, backport=dveditz, a=dveditz
content/html/document/src/nsHTMLDocument.cpp
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@@ -1819,16 +1819,26 @@ nsHTMLDocument::OpenCommon(const nsACStr
                "XOW should have caught this!");
 
   if (!aContentType.EqualsLiteral("text/html") &&
       !aContentType.EqualsLiteral("text/plain")) {
     NS_WARNING("Unsupported type; fix the caller");
     return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
   }
 
+  // No calling document.open() without a script global object
+  if (!mScriptGlobalObject) {
+    return NS_OK;
+  }
+
+  nsPIDOMWindow* outer = GetWindow();
+  if (!outer || (GetInnerWindow() != outer->GetCurrentInnerWindow())) {
+    return NS_OK;
+  }
+
   // check whether we're in the middle of unload.  If so, ignore this call.
   nsCOMPtr<nsIDocShell> shell = do_QueryReferent(mDocumentContainer);
   if (!shell) {
     // We won't be able to create a parser anyway.
     return NS_OK;
   }
 
   PRBool inUnload;