Bug 1426002. Bail out of document.open if beforeunload tears things down. r=mystor

MozReview-Commit-ID: GDozCq4Qbni
2017-12-21 15:08:49 -05:00
parent f96a317cae
commit b5b49f64bb
1 changed files with 12 additions and 0 deletions
--- a/dom/html/nsHTMLDocument.cpp
+++ b/dom/html/nsHTMLDocument.cpp
@@ -1598,6 +1598,18 @@ nsHTMLDocument::Open(JSContext* cx,
        nsCOMPtr<nsIDocument> ret = this;
        return ret.forget();
      }
+
+      // Now double-check that our invariants still hold.
+      if (!mScriptGlobalObject) {
+        nsCOMPtr<nsIDocument> ret = this;
+        return ret.forget();
+      }
+
+      nsPIDOMWindowOuter* outer = GetWindow();
+      if (!outer || (GetInnerWindow() != outer->GetCurrentInnerWindow())) {
+        nsCOMPtr<nsIDocument> ret = this;
+        return ret.forget();
+      }
    }

    nsCOMPtr<nsIWebNavigation> webnav(do_QueryInterface(shell));