Closed Bug 1997773 Opened 1 year ago Closed 1 year ago

Consider hiding the frame loader earlier in nsFrameLoader::Destroy.

Categories

(Core :: DOM: Navigation, task)

task

Tracking

()

RESOLVED FIXED
146 Branch
Tracking Status
firefox146 --- fixed

People

(Reporter: emilio, Assigned: emilio)

References

Details

Attachments

(1 external file)

No description provided.

Yeah, I know... non-trivial one-liner.

I found some weirdness while looking at bug 1994942. Issue is that I
tried to remove the nsView dependency by looking at the embedder
element (right now layout goes from child to parent frame via the view
tree).

This mostly works, except when the presshell is destroyed after the
frameloader. This patch prevents that from happening and makes the
timing a bit more predictable between subframes / reframes and process
switches, even though I ultimately found a workaround for that bug.

Pushed by ealvarez@mozilla.com: https://github.com/mozilla-firefox/firefox/commit/866e3560b261 https://hg.mozilla.org/integration/autoland/rev/69fb6930ebd4 Hide frameloader before nulling out embedder element from nsFrameLoader::Destroy(). r=smaug
Status: ASSIGNED → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Target Milestone: --- → 146 Branch
QA Whiteboard: [qa-triage-done-c147/b146]
Regressions: CVE-2025-14860
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: