Issue #2452 - Prevent nsDocShell access when it is already being destroyed

https://bugzilla.mozilla.org/show_bug.cgi?id=1432396
This commit is contained in:
Martok 2024-01-14 22:31:26 +01:00 committed by roytam1
commit 2a533c943d
3 changed files with 76 additions and 9 deletions

View file

@ -100,6 +100,7 @@ nsContentSink::nsContentSink()
, mDeferredFlushTags(0)
, mIsDocumentObserver(0)
, mRunsToCompletion(0)
, mIsBlockingOnload(false)
, mDeflectedCount(0)
, mHasPendingEvent(false)
, mCurrentParseEndTime(0)
@ -1539,8 +1540,14 @@ nsContentSink::DropParserAndPerfHint(void)
FavorPerformanceHint(true, 0);
}
if (!mRunsToCompletion) {
// Call UnblockOnload only if mRunsToComletion is false and if
// we have already started loading because it's possible that this function
// is called (i.e. the parser is terminated) before we start loading due to
// destroying the window inside unload event callbacks for the previous
// document.
if (!mRunsToCompletion && mIsBlockingOnload) {
mDocument->UnblockOnload(true);
mIsBlockingOnload = false;
}
}
@ -1595,6 +1602,7 @@ nsContentSink::WillBuildModelImpl()
{
if (!mRunsToCompletion) {
mDocument->BlockOnload();
mIsBlockingOnload = true;
mBeginLoadTime = PR_IntervalToMicroseconds(PR_IntervalNow());
}