1575321 - Fix usage of nsIDocShellTreeItem in nsDocShell::Destroy

Status: NEW

(Core :: DOM: Navigation, enhancement, P2)

Description

[Kannan Vijayan [:djvj]]

https://searchfox.org/mozilla-central/source/docshell/base/nsDocShell.cpp#4918

Here, the destroy code calls RemoveChild on the parent docshell, referenced directly from mParent. The parent may be null in post-fission semantics, if it's out of process.

The destroy code should detach the parent if it exists, but additionally also detach the corresponding BrowsingContext from its parent BrowsingContext.

Comment 1

[Kannan Vijayan [:djvj]]

Check if this bug is still valid or got fixed by andreas.

Comment 2

[Kannan Vijayan [:djvj]]

Andreas - is there a bug for the overall fission docshell destroy work I can link this to? Has that work landed or is it still in progress?

Comment 3

[Andreas Farre [:farre]]

I think that this now is the bug for the overall fission docshell destroy work! :D

Generally I'm not very happy with how nsDocShell::Destoy works, and something that I think we need to clean up. Today, nsDocShell::Destroy drives much of BrowsingContext tear down as well, which isn't super-ideal.

This is definitely work in progress, but more on a needs basis, than a focused effort.

Comment 4

[Chris Peterson [:cpeterson]]

Kannan says replacing nsIDocShellTreeItem calls should block enabling Fission in Nightly (M6).

Comment 5

[Nika Layzell [:nika] (ni? for response)]

The BrowsingContext destroy work has generally been disconnected from the lifecycle of the nsDocShell since bug 1582832. The remaining work mentioned in this bug is just related to removing a user of nsIDocShellTreeItem related to nsIDocShellTreeItem lifecycles. Moving to future.