292978 - Firing restore events can mutate the docshell tree

Status: RESOLVED INCOMPLETE

(Core :: DOM: Navigation, defect)

Description

[Boris Zbarsky [:bzbarsky]]

FireRestoreEvents can trigger docshell tree mutations by event handlers.  Since
we're iterating mChildList, which can change during said mutations, we need to
figure out exactly what behavior we want here.

Comment 1

[Brian Ryner (not reading)]

The code isn't quite the same as when this was filed.  Now, the events are
dispatched when FinishRestore is called, which happens on a plevent.  There may
still be a situation where handling a restore for one docshell removes elements
from the child list such that a later docshell doesn't get restore called on it
at all.  We could probably solve this by building up the list of children to
fire restore before we actually walk the list.

I don't think this is likely to be a problem on the web though, since these
events are brand-new.  I think this is probably something we can fix in a point
release.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

In the process of migrating remaining bugs to the new severity system, the severity for this bug cannot be automatically determined. Please retriage this bug using the new severity system.

Comment 3

[Henri Sivonen (:hsivonen) (not reading bugmail until 2024-09-04)]

Lacks steps to repro.