AfterOnloadScripts can use an old document element

RESOLVED FIXED in mozilla14

Status

Testing
Reftest
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: khuey, Assigned: khuey)

Tracking

unspecified
mozilla14
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment, 1 obsolete attachment)

Created attachment 615257 [details] [diff] [review]
Patch

e.g. in 483818-1.html, where the document is replaced by a document.write.
Attachment #615257 - Flags: review?(dbaron)
Created attachment 616378 [details] [diff] [review]
Patch

There's another issue here, which is that we hold onto a <canvas> from the first document indefinitely.
Attachment #616378 - Flags: review?(dbaron)
Attachment #615257 - Attachment is obsolete: true
Attachment #615257 - Flags: review?(dbaron)
Comment on attachment 616378 [details] [diff] [review]
Patch

Maybe also null-out currentDoc after its last use (in OnDocumentLoad) so that the its inner functions can't later use it?  r=dbaron
Attachment #616378 - Flags: review?(dbaron) → review+
http://hg.mozilla.org/mozilla-central/rev/b9936b8bcccf
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla14
You need to log in before you can comment on or make changes to this bug.