summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorwolfbeast <mcwerewolf@gmail.com>2018-03-17 14:30:49 +0100
committerwolfbeast <mcwerewolf@gmail.com>2018-03-17 14:30:49 +0100
commit6698bbf1077dfbbbd9f35c95ada1544eb59aa0f1 (patch)
tree048f37b89d4eae79137026d1a6bc869c1bab15af
parent0ae2ab78b9b00f177bdf0c1f64811ad416e6c7a5 (diff)
downloadUXP-6698bbf1077dfbbbd9f35c95ada1544eb59aa0f1.tar
UXP-6698bbf1077dfbbbd9f35c95ada1544eb59aa0f1.tar.gz
UXP-6698bbf1077dfbbbd9f35c95ada1544eb59aa0f1.tar.lz
UXP-6698bbf1077dfbbbd9f35c95ada1544eb59aa0f1.tar.xz
UXP-6698bbf1077dfbbbd9f35c95ada1544eb59aa0f1.zip
Bug 1426002. Bail out of document.open if beforeunload tears things down. r=mystor
-rw-r--r--dom/html/nsHTMLDocument.cpp12
1 files changed, 12 insertions, 0 deletions
diff --git a/dom/html/nsHTMLDocument.cpp b/dom/html/nsHTMLDocument.cpp
index fea78dc37..be5a34d41 100644
--- a/dom/html/nsHTMLDocument.cpp
+++ b/dom/html/nsHTMLDocument.cpp
@@ -1536,6 +1536,18 @@ nsHTMLDocument::Open(JSContext* cx,
nsCOMPtr<nsIDocument> ret = this;
return ret.forget();
}
+
+ // Now double-check that our invariants still hold.
+ if (!mScriptGlobalObject) {
+ nsCOMPtr<nsIDocument> ret = this;
+ return ret.forget();
+ }
+
+ nsPIDOMWindowOuter* outer = GetWindow();
+ if (!outer || (GetInnerWindow() != outer->GetCurrentInnerWindow())) {
+ nsCOMPtr<nsIDocument> ret = this;
+ return ret.forget();
+ }
}
nsCOMPtr<nsIWebNavigation> webnav(do_QueryInterface(shell));