summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--dom/base/ResizeObserverController.cpp12
1 files changed, 10 insertions, 2 deletions
diff --git a/dom/base/ResizeObserverController.cpp b/dom/base/ResizeObserverController.cpp
index 349cb66ba..d4166155e 100644
--- a/dom/base/ResizeObserverController.cpp
+++ b/dom/base/ResizeObserverController.cpp
@@ -119,6 +119,10 @@ ResizeObserverController::Notify()
return;
}
+ // Hold a strong reference to the document, because otherwise calling
+ // all active observers on it might yank it out from under us.
+ RefPtr<nsIDocument> document(mDocument);
+
uint32_t shallowestTargetDepth = 0;
GatherAllActiveObservations(shallowestTargetDepth);
@@ -153,7 +157,7 @@ ResizeObserverController::Notify()
nsEventStatus status = nsEventStatus_eIgnore;
nsCOMPtr<nsPIDOMWindowInner> window =
- mDocument->GetWindow()->GetCurrentInnerWindow();
+ document->GetWindow()->GetCurrentInnerWindow();
if (window) {
nsCOMPtr<nsIScriptGlobalObject> sgo = do_QueryInterface(window);
@@ -185,7 +189,11 @@ ResizeObserverController::BroadcastAllActiveObservations()
{
uint32_t shallowestTargetDepth = UINT32_MAX;
- for (auto observer : mResizeObservers) {
+ // Use a copy of the observers as this invokes the callbacks of the observers
+ // which could register/unregister observers at will.
+ nsTArray<RefPtr<ResizeObserver>> tempObservers(mResizeObservers);
+
+ for (auto observer : tempObservers) {
uint32_t targetDepth = observer->BroadcastActiveObservations();