diff --git a/mozilla/content/base/public/nsIDocument.h b/mozilla/content/base/public/nsIDocument.h
index 289466a9425..8f185e6ba46 100644
--- a/mozilla/content/base/public/nsIDocument.h
+++ b/mozilla/content/base/public/nsIDocument.h
@@ -97,8 +97,8 @@ class nsFrameLoader;
// IID for the nsIDocument interface
#define NS_IDOCUMENT_IID \
-{ 0xdd40333d, 0x913c, 0x4909, \
- { 0xb9, 0xe8, 0xf5, 0x45, 0x56, 0x5c, 0xe5, 0x4e } }
+{ 0xc81acf0b, 0x2539, 0x47ab, \
+ { 0xa6, 0x04, 0x64, 0x04, 0x07, 0x63, 0xc8, 0x3d } }
// Flag for AddStyleSheet().
#define NS_STYLESHEET_FROM_CATALOG (1 << 0)
@@ -964,8 +964,10 @@ public:
// In case of failure, the caller must handle the error, for example by
// finalizing frame loader asynchronously.
virtual nsresult FinalizeFrameLoader(nsFrameLoader* aLoader) = 0;
-
+ // Removes the frame loader of aShell from the initialization list.
virtual void TryCancelFrameLoaderInitialization(nsIDocShell* aShell) = 0;
+ // Returns true if the frame loader of aShell is in the finalization list.
+ virtual PRBool FrameLoaderScheduledToBeFinalized(nsIDocShell* aShell) = 0;
protected:
~nsIDocument()
{
diff --git a/mozilla/content/base/src/nsDocument.cpp b/mozilla/content/base/src/nsDocument.cpp
index ea351f5119f..a22c2793530 100644
--- a/mozilla/content/base/src/nsDocument.cpp
+++ b/mozilla/content/base/src/nsDocument.cpp
@@ -3924,6 +3924,20 @@ nsDocument::TryCancelFrameLoaderInitialization(nsIDocShell* aShell)
}
}
+PRBool
+nsDocument::FrameLoaderScheduledToBeFinalized(nsIDocShell* aShell)
+{
+ if (aShell) {
+ PRUint32 length = mFinalizableFrameLoaders.Length();
+ for (PRUint32 i = 0; i < length; ++i) {
+ if (mFinalizableFrameLoaders[i]->GetExistingDocShell() == aShell) {
+ return PR_TRUE;
+ }
+ }
+ }
+ return PR_FALSE;
+}
+
struct DirTable {
const char* mName;
PRUint8 mValue;
diff --git a/mozilla/content/base/src/nsDocument.h b/mozilla/content/base/src/nsDocument.h
index 230eb03c574..fe12ca7a7aa 100644
--- a/mozilla/content/base/src/nsDocument.h
+++ b/mozilla/content/base/src/nsDocument.h
@@ -652,6 +652,7 @@ public:
virtual NS_HIDDEN_(nsresult) InitializeFrameLoader(nsFrameLoader* aLoader);
virtual NS_HIDDEN_(nsresult) FinalizeFrameLoader(nsFrameLoader* aLoader);
virtual NS_HIDDEN_(void) TryCancelFrameLoaderInitialization(nsIDocShell* aShell);
+ virtual NS_HIDDEN_(PRBool) FrameLoaderScheduledToBeFinalized(nsIDocShell* aShell);
NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsDocument, nsIDocument)
diff --git a/mozilla/content/base/test/Makefile.in b/mozilla/content/base/test/Makefile.in
index f8aac02efdf..c8a78d228fe 100644
--- a/mozilla/content/base/test/Makefile.in
+++ b/mozilla/content/base/test/Makefile.in
@@ -163,6 +163,9 @@ _TEST_FILES = test_bug5141.html \
test_bug425013.html \
bug426308-redirect.sjs \
test_bug426308.html \
+ test_bug426646.html \
+ file_bug426646-1.html \
+ file_bug426646-2.html \
test_bug429157.html \
test_XHR.html \
file_XHR_pass1.xml \
diff --git a/mozilla/content/base/test/file_bug426646-1.html b/mozilla/content/base/test/file_bug426646-1.html
new file mode 100644
index 00000000000..208cbd9e469
--- /dev/null
+++ b/mozilla/content/base/test/file_bug426646-1.html
@@ -0,0 +1,32 @@
+
+Bug 426646, Using location.replace breaks iframe history
+
+
+
+
diff --git a/mozilla/content/base/test/file_bug426646-2.html b/mozilla/content/base/test/file_bug426646-2.html
new file mode 100644
index 00000000000..438a675041f
--- /dev/null
+++ b/mozilla/content/base/test/file_bug426646-2.html
@@ -0,0 +1,40 @@
+
+Bug 426646, Using location.replace breaks iframe history
+
+
+
+
diff --git a/mozilla/content/base/test/test_bug426646.html b/mozilla/content/base/test/test_bug426646.html
new file mode 100644
index 00000000000..4a27f816c03
--- /dev/null
+++ b/mozilla/content/base/test/test_bug426646.html
@@ -0,0 +1,42 @@
+
+
+
+
+ Test for Bug 426646
+
+
+
+
+
+Mozilla Bug 426646
+
+
+
+
+
+
+
+
+
+
diff --git a/mozilla/docshell/base/nsDocShell.cpp b/mozilla/docshell/base/nsDocShell.cpp
index e8cb7ce98ea..3c7110e5930 100644
--- a/mozilla/docshell/base/nsDocShell.cpp
+++ b/mozilla/docshell/base/nsDocShell.cpp
@@ -2366,8 +2366,26 @@ nsDocShell::AddChild(nsIDocShellTreeItem * aChild)
// XXX in that case docshell hierarchy and SH hierarchy won't match.
{
nsCOMPtr childDocShell = do_QueryInterface(aChild);
- if (childDocShell)
- childDocShell->SetChildOffset(mChildList.Count() - 1);
+ if (childDocShell) {
+ // If there are frameloaders in the finalization list, reduce
+ // the offset so that the SH hierarchy is more likely to match the
+ // docshell hierarchy
+ nsCOMPtr domDoc =
+ do_GetInterface(GetAsSupports(this));
+ nsCOMPtr doc = do_QueryInterface(domDoc);
+ PRUint32 offset = mChildList.Count() - 1;
+ if (doc) {
+ PRUint32 oldChildCount = offset; // Current child count - 1
+ for (PRUint32 i = 0; i < oldChildCount; ++i) {
+ nsCOMPtr child = do_QueryInterface(ChildAt(i));
+ if (doc->FrameLoaderScheduledToBeFinalized(child)) {
+ --offset;
+ }
+ }
+ }
+
+ childDocShell->SetChildOffset(offset);
+ }
}
/* Set the child's global history if the parent has one */