guix-devel/gnu/packages/patches/icecat-CVE-2016-2818-pt1.patch

63 lines
2.6 KiB
Diff

changeset: 312039:4290826b078c
user: Timothy Nikkel <tnikkel@gmail.com>
Date: Fri May 13 06:09:38 2016 +0200
summary: Bug 1261230. r=mats, a=ritu
diff -r 45a59425b498 -r 4290826b078c layout/generic/nsSubDocumentFrame.cpp
--- a/layout/generic/nsSubDocumentFrame.cpp Tue May 10 14:12:20 2016 +0200
+++ b/layout/generic/nsSubDocumentFrame.cpp Fri May 13 06:09:38 2016 +0200
@@ -132,6 +132,7 @@
nsCOMPtr<nsIDocument> oldContainerDoc;
nsView* detachedViews =
frameloader->GetDetachedSubdocView(getter_AddRefs(oldContainerDoc));
+ frameloader->SetDetachedSubdocView(nullptr, nullptr);
if (detachedViews) {
if (oldContainerDoc == aContent->OwnerDoc()) {
// Restore stashed presentation.
@@ -142,7 +143,6 @@
frameloader->Hide();
}
}
- frameloader->SetDetachedSubdocView(nullptr, nullptr);
}
nsContentUtils::AddScriptRunner(new AsyncFrameInit(this));
@@ -936,13 +936,16 @@
if (!mPresShell->IsDestroying()) {
mPresShell->FlushPendingNotifications(Flush_Frames);
}
+
+ // Either the frame has been constructed by now, or it never will be,
+ // either way we want to clear the stashed views.
+ mFrameLoader->SetDetachedSubdocView(nullptr, nullptr);
+
nsSubDocumentFrame* frame = do_QueryFrame(mFrameElement->GetPrimaryFrame());
if ((!frame && mHideViewerIfFrameless) ||
mPresShell->IsDestroying()) {
// Either the frame element has no nsIFrame or the presshell is being
- // destroyed. Hide the nsFrameLoader, which destroys the presentation,
- // and clear our references to the stashed presentation.
- mFrameLoader->SetDetachedSubdocView(nullptr, nullptr);
+ // destroyed. Hide the nsFrameLoader, which destroys the presentation.
mFrameLoader->Hide();
}
return NS_OK;
@@ -968,7 +971,7 @@
// Detach the subdocument's views and stash them in the frame loader.
// We can then reattach them if we're being reframed (for example if
// the frame has been made position:fixed).
- nsFrameLoader* frameloader = FrameLoader();
+ RefPtr<nsFrameLoader> frameloader = FrameLoader();
if (frameloader) {
nsView* detachedViews = ::BeginSwapDocShellsForViews(mInnerView->GetFirstChild());
frameloader->SetDetachedSubdocView(detachedViews, mContent->OwnerDoc());
@@ -977,7 +980,7 @@
// safely determine whether the frame is being reframed or destroyed.
nsContentUtils::AddScriptRunner(
new nsHideViewer(mContent,
- mFrameLoader,
+ frameloader,
PresContext()->PresShell(),
(mDidCreateDoc || mCallingShow)));
}