Bug 1450164 - Don't update URIs on history adds on docshells that are being shut down; r=bzbarsky

If we add to history on a docshell that is being shut down, add
history entry but skip trying to load the new URI.

MozReview-Commit-ID: JCF9muhxbFd

Differential Revision: https://phabricator.services.mozilla.com/D2311

docshell/base/nsDocShell.cpp

@@ -11751,7 +11751,10 @@ nsDocShell::AddState(JS::Handle<JS::Value> aData, const nsAString& aTitle,
   // notification is allowed only when we know docshell is not loading a new
   // document and it requires LOCATION_CHANGE_SAME_DOCUMENT flag. Otherwise,
   // FireOnLocationChange(...) breaks security UI.
-  if (!equalURIs) {
+  //
+  // If the docshell is shutting down, don't update the document URI, as we
+  // can't load into a docshell that is being destroyed.
+  if (!equalURIs && !mIsBeingDestroyed) {
     document->SetDocumentURI(newURI);
     // We can't trust SetCurrentURI to do always fire locationchange events
     // when we expect it to, so we hack around that by doing it ourselves...