Issue #618 - Clear the module map when changing a Document's global and add

release build assertions for mismatching compartments.

3 files changed, 14 insertions, 0 deletions

diff --git a/dom/html/nsHTMLDocument.cpp b/dom/html/nsHTMLDocument.cpp
index f3cb096b9..9d0b2c9bb 100644
--- a/dom/html/nsHTMLDocument.cpp
+++ b/dom/html/nsHTMLDocument.cpp
@@ -1471,6 +1471,9 @@ nsHTMLDocument::Open(JSContext* cx,
     // document again otherwise the document could have a non-zero onload block
     // count without the onload blocker request being in the loadgroup.
     EnsureOnloadBlocker();
+
+    // Throw away loaded modules created for the previous global.
+    ScriptLoader()->ClearModuleMap();
   }
 
   // Step 8 - Clear all event listeners out of our DOM tree
diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
index 71838580f..362c27f3e 100644
--- a/dom/script/ScriptLoader.cpp
+++ b/dom/script/ScriptLoader.cpp
@@ -477,6 +477,11 @@ ScriptLoader::GetFetchedModule(nsIURI* aURL) const
   return ms;
 }
 
+void ScriptLoader::ClearModuleMap() {
+  MOZ_ASSERT(mFetchingModules.IsEmpty());
+  mFetchedModules.Clear();
+}
+
 nsresult
 ScriptLoader::ProcessFetchedModuleSource(ModuleLoadRequest* aRequest)
 {
diff --git a/dom/script/ScriptLoader.h b/dom/script/ScriptLoader.h
index 2c5b683e7..73f2a9258 100644
--- a/dom/script/ScriptLoader.h
+++ b/dom/script/ScriptLoader.h
@@ -506,6 +506,12 @@ public:
     return mPendingChildLoaders.AppendElement(aChild) != nullptr;
   }
 
+  /*
+   * Clear the map of loaded modules. Called when a Document object is reused
+   * for a different global.
+   */
+  void ClearModuleMap();
+
 private:
   virtual ~ScriptLoader();