Bug 1253792 - Handle another case of re-entrancy through nsDocShell::InternalLoad. r=smaug, a=ritu
authorBlake Kaplan <mrbkap@gmail.com>
Wed, 09 Mar 2016 12:26:00 -0500
changeset 323462 3073821bd42e7e4dd6e8d8eb3bc1edd8b46a0f6e
parent 323461 93f4293d8302d7e16314aeffd41d835b73ace5d4
child 323463 767ba84ebf953f03bf2057c2ffbe1e90a8d3a7d6
push id5913
push userjlund@mozilla.com
push dateMon, 25 Apr 2016 16:57:49 +0000
treeherdermozilla-beta@dcaf0a6fa115 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssmaug, ritu
bugs1253792
milestone47.0a2
Bug 1253792 - Handle another case of re-entrancy through nsDocShell::InternalLoad. r=smaug, a=ritu
docshell/base/nsDocShell.cpp
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -10585,17 +10585,23 @@ nsDocShell::DoURILoad(nsIURI* aURI,
 
   nsCOMPtr<nsIPrincipal> loadingPrincipal;
   if (mScriptGlobal) {
     requestingNode = mScriptGlobal->AsOuter()->GetFrameElementInternal();
     if (requestingNode) {
       // If we have a requesting node, then use that as our loadingPrincipal.
       loadingPrincipal = requestingNode->NodePrincipal();
     } else {
-      MOZ_ASSERT(aContentPolicyType == nsIContentPolicy::TYPE_DOCUMENT);
+      if (aContentPolicyType != nsIContentPolicy::TYPE_DOCUMENT) {
+        // If this isn't a top-level load and mScriptGlobal's frame element is
+        // null, then the element got removed from the DOM while we were trying to
+        // load this resource. This docshell is scheduled for destruction already,
+        // so bail out here.
+        return NS_OK;
+      }
       requestingWindow = mScriptGlobal->AsOuter();
     }
   }
 
   if (!loadingPrincipal) {
     if (mItemType != typeChrome) {
       nsIScriptSecurityManager* ssm = nsContentUtils::GetSecurityManager();
       ssm->GetDocShellCodebasePrincipal(aURI, this, getter_AddRefs(loadingPrincipal));