Bug 1498720 - Ensure that we revoke a subframe's storage access when it is removed from the DOM r=baku

Differential Revision: https://phabricator.services.mozilla.com/D8615

docshell/base/nsDocShell.cpp

@@ -2988,6 +2988,12 @@ nsDocShell::SetDocLoaderParent(nsDocLoader* aParent)
   // Our parent has changed. Recompute scriptability.
   RecomputeCanExecuteScripts();
 
+  nsCOMPtr<nsPIDOMWindowOuter> window = GetWindow();
+  if (window) {
+    auto* win = nsGlobalWindowOuter::Cast(window);
+    win->ParentWindowChanged();
+  }
+
   NS_ASSERTION(mInheritPrivateBrowsingId || wasPrivate == UsePrivateBrowsing(),
                "Private browsing state changed while inheritance was disabled");
 

dom/base/nsGlobalWindowOuter.h

@@ -737,6 +737,12 @@ public:
     return GetExtantDoc() && GetExtantDoc()->IsInSyncOperation();
   }
 
+  void ParentWindowChanged()
+  {
+    // Reset our storage access flag when we get reparented.
+    mHasStorageAccess = false;
+  }
+
 public:
   int32_t GetInnerWidthOuter(mozilla::ErrorResult& aError);
 protected: