diff options
| -rw-r--r-- | dom/base/ResizeObserverController.cpp | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/dom/base/ResizeObserverController.cpp b/dom/base/ResizeObserverController.cpp index 349cb66ba..d4166155e 100644 --- a/dom/base/ResizeObserverController.cpp +++ b/dom/base/ResizeObserverController.cpp @@ -119,6 +119,10 @@ ResizeObserverController::Notify() return; } + // Hold a strong reference to the document, because otherwise calling + // all active observers on it might yank it out from under us. + RefPtr<nsIDocument> document(mDocument); + uint32_t shallowestTargetDepth = 0; GatherAllActiveObservations(shallowestTargetDepth); @@ -153,7 +157,7 @@ ResizeObserverController::Notify() nsEventStatus status = nsEventStatus_eIgnore; nsCOMPtr<nsPIDOMWindowInner> window = - mDocument->GetWindow()->GetCurrentInnerWindow(); + document->GetWindow()->GetCurrentInnerWindow(); if (window) { nsCOMPtr<nsIScriptGlobalObject> sgo = do_QueryInterface(window); @@ -185,7 +189,11 @@ ResizeObserverController::BroadcastAllActiveObservations() { uint32_t shallowestTargetDepth = UINT32_MAX; - for (auto observer : mResizeObservers) { + // Use a copy of the observers as this invokes the callbacks of the observers + // which could register/unregister observers at will. + nsTArray<RefPtr<ResizeObserver>> tempObservers(mResizeObservers); + + for (auto observer : tempObservers) { uint32_t targetDepth = observer->BroadcastActiveObservations(); |