summaryrefslogtreecommitdiffstats
path: root/dom/base/ResizeObserverController.cpp
diff options
context:
space:
mode:
authorMoonchild <moonchild@palemoon.org>2020-09-30 16:03:36 +0000
committerMoonchild <moonchild@palemoon.org>2020-09-30 16:03:36 +0000
commitd11196927acb017c6ea8a741102906041c447778 (patch)
treec986d243c1eaf910a7e5970adc6926bcea01f55e /dom/base/ResizeObserverController.cpp
parent5a9f8ae723892a58784968d15ac0a3a8f0c97357 (diff)
downloadUXP-d11196927acb017c6ea8a741102906041c447778.tar
UXP-d11196927acb017c6ea8a741102906041c447778.tar.gz
UXP-d11196927acb017c6ea8a741102906041c447778.tar.lz
UXP-d11196927acb017c6ea8a741102906041c447778.tar.xz
UXP-d11196927acb017c6ea8a741102906041c447778.zip
Issue #1643 - Follow-up: Make sure things aren't changed while iterating.
This fixes some crashing scenarios.
Diffstat (limited to 'dom/base/ResizeObserverController.cpp')
-rw-r--r--dom/base/ResizeObserverController.cpp12
1 files changed, 10 insertions, 2 deletions
diff --git a/dom/base/ResizeObserverController.cpp b/dom/base/ResizeObserverController.cpp
index 349cb66ba..d4166155e 100644
--- a/dom/base/ResizeObserverController.cpp
+++ b/dom/base/ResizeObserverController.cpp
@@ -119,6 +119,10 @@ ResizeObserverController::Notify()
return;
}
+ // Hold a strong reference to the document, because otherwise calling
+ // all active observers on it might yank it out from under us.
+ RefPtr<nsIDocument> document(mDocument);
+
uint32_t shallowestTargetDepth = 0;
GatherAllActiveObservations(shallowestTargetDepth);
@@ -153,7 +157,7 @@ ResizeObserverController::Notify()
nsEventStatus status = nsEventStatus_eIgnore;
nsCOMPtr<nsPIDOMWindowInner> window =
- mDocument->GetWindow()->GetCurrentInnerWindow();
+ document->GetWindow()->GetCurrentInnerWindow();
if (window) {
nsCOMPtr<nsIScriptGlobalObject> sgo = do_QueryInterface(window);
@@ -185,7 +189,11 @@ ResizeObserverController::BroadcastAllActiveObservations()
{
uint32_t shallowestTargetDepth = UINT32_MAX;
- for (auto observer : mResizeObservers) {
+ // Use a copy of the observers as this invokes the callbacks of the observers
+ // which could register/unregister observers at will.
+ nsTArray<RefPtr<ResizeObserver>> tempObservers(mResizeObservers);
+
+ for (auto observer : tempObservers) {
uint32_t targetDepth = observer->BroadcastActiveObservations();