From c5466a75d13babb3051937512580be614f0b95fa Mon Sep 17 00:00:00 2001 From: "martijn.martijn%gmail.com" Date: Wed, 5 Apr 2006 23:57:30 +0000 Subject: [PATCH] Bug 331040 - Crash when removing parent iframe in onbeforunload handler. Patch by Feng Qian, r=bryner, sr=bzbarsky git-svn-id: svn://10.0.0.236/trunk@193646 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/docshell/base/nsDocShell.cpp | 9 +++++++++ mozilla/layout/base/nsDocumentViewer.cpp | 8 ++++---- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/mozilla/docshell/base/nsDocShell.cpp b/mozilla/docshell/base/nsDocShell.cpp index 80093e2b150..1fbada35719 100644 --- a/mozilla/docshell/base/nsDocShell.cpp +++ b/mozilla/docshell/base/nsDocShell.cpp @@ -4856,6 +4856,9 @@ nsDocShell::CreateAboutBlankContentViewer() mCreatingDocument = PR_TRUE; + // mContentViewer->PermitUnload may release |this| docshell. + nsCOMPtr kungFuDeathGrip(this); + if (mContentViewer) { // We've got a content viewer already. Make sure the user // permits us to discard the current document and replace it @@ -6494,6 +6497,12 @@ nsDocShell::InternalLoad(nsIURI * aURI, return NS_OK; } } + + // mContentViewer->PermitUnload can destroy |this| docShell, which + // causes the next call of CanSavePresentation to crash. + // Hold onto |this| until we return, to prevent a crash from happening. + // (bug#331040) + nsCOMPtr kungFuDeathGrip(this); // Check if the page doesn't want to be unloaded. The javascript: // protocol handler deals with this for javascript: URLs. diff --git a/mozilla/layout/base/nsDocumentViewer.cpp b/mozilla/layout/base/nsDocumentViewer.cpp index f9c872f2009..35b8d134e5a 100644 --- a/mozilla/layout/base/nsDocumentViewer.cpp +++ b/mozilla/layout/base/nsDocumentViewer.cpp @@ -1150,15 +1150,15 @@ DocumentViewerImpl::PermitUnload(PRBool *aPermitUnload) event.target = mDocument; nsresult rv = NS_OK; + // In evil cases we might be destroyed while handling the + // onbeforeunload event, don't let that happen. (see also bug#331040) + nsRefPtr kungFuDeathGrip(this); + { // Never permit popups from the beforeunload handler, no matter // how we get here. nsAutoPopupStatePusher popupStatePusher(openAbused, PR_TRUE); - // In evil cases we might be destroyed while handling the - // onbeforeunload event, don't let that happen. - nsRefPtr kungFuDeathGrip(this); - mInPermitUnload = PR_TRUE; nsEventDispatcher::Dispatch(window, mPresContext, &event, nsnull, &status); mInPermitUnload = PR_FALSE;