Bug 1517415. We might be trying to JS-wrap a BrowsingContext with a torn-down-enough docshell that we have no window. r=nika
authorBoris Zbarsky <bzbarsky@mit.edu>
Thu, 03 Jan 2019 20:31:05 +0000
changeset 509571 2abc6090d9f41d876da227077b244cb6cc1702c7
parent 509570 7c45873d6989034f4823fe14501a685aae3e787d
child 509572 4d42e4786e4fef58c9fd4e26f0f35dcc9cdf3df3
push id10547
push userffxbld-merge
push dateMon, 21 Jan 2019 13:03:58 +0000
treeherdermozilla-beta@24ec1916bffe [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnika
bugs1517415
milestone66.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1517415. We might be trying to JS-wrap a BrowsingContext with a torn-down-enough docshell that we have no window. r=nika The old code did this check in GetContentWindow, basically. We _could_ just put the null-check there, but this seems safer. Differential Revision: https://phabricator.services.mozilla.com/D15676
dom/bindings/ToJSValue.cpp
--- a/dom/bindings/ToJSValue.cpp
+++ b/dom/bindings/ToJSValue.cpp
@@ -68,16 +68,21 @@ bool ToJSValue(JSContext* aCx, const Win
     aValue.setNull();
     return true;
   }
   JS::Rooted<JSObject*> windowProxy(aCx);
   if (bc->GetDocShell()) {
     windowProxy = bc->GetWindowProxy();
     if (!windowProxy) {
       nsPIDOMWindowOuter* window = bc->GetDOMWindow();
+      if (!window) {
+        // Torn down enough that we should just return null.
+        aValue.setNull();
+        return true;
+      }
       if (!window->EnsureInnerWindow()) {
         return Throw(aCx, NS_ERROR_UNEXPECTED);
       }
       windowProxy = bc->GetWindowProxy();
     }
     return ToJSValue(aCx, windowProxy, aValue);
   }