Bug 1625513 - Part 5: Don't run sandboxed srcdoc loads through DocumentChannel, r=mattwoodrow

Differential Revision: https://phabricator.services.mozilla.com/D71688
This commit is contained in:
Nika Layzell
2020-04-21 18:33:54 +00:00
parent 07bd64e930
commit ae19c18d3c

View File

@@ -9742,14 +9742,14 @@ nsresult nsDocShell::DoURILoad(nsDocShellLoadState* aLoadState,
cacheKey = mOSHE->GetCacheKey();
}
// We want to use DocumentChannel if we're using a supported scheme, or if
// we're a sandboxed srcdoc load. Non-sandboxed srcdoc loads need to share
// the same principal object as their outer document (and must load in the
// same process), which breaks if we serialize to the parent process.
// We want to use DocumentChannel if we're using a supported scheme. Sandboxed
// srcdoc loads break due to failing assertions after changing processes, and
// non-sandboxed srcdoc loads need to share the same principal object as their
// outer document (and must load in the same process), which breaks if we
// serialize to the parent process.
bool canUseDocumentChannel =
aLoadState->HasLoadFlags(INTERNAL_LOAD_FLAGS_IS_SRCDOC)
? (sandboxFlags & SANDBOXED_ORIGIN)
: URIUsesDocChannel(aLoadState->URI());
!aLoadState->HasLoadFlags(INTERNAL_LOAD_FLAGS_IS_SRCDOC) &&
URIUsesDocChannel(aLoadState->URI());
if (StaticPrefs::browser_tabs_documentchannel() && XRE_IsContentProcess() &&
canUseDocumentChannel) {