From e6733c9278d0e9687be83de5b5f409a43653fbee Mon Sep 17 00:00:00 2001 From: Gaming4JC Date: Sat, 4 Jan 2020 22:05:07 -0500 Subject: Bug 1315885 - Part 3: Transfer the ownership of ReactionQueue's entry due to re-enter CustomElementReactionsStack::InvokeReactions. Tag UXP Issue #1344 --- dom/base/CustomElementRegistry.cpp | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/dom/base/CustomElementRegistry.cpp b/dom/base/CustomElementRegistry.cpp index 249162c38..6419c1425 100644 --- a/dom/base/CustomElementRegistry.cpp +++ b/dom/base/CustomElementRegistry.cpp @@ -974,6 +974,7 @@ CustomElementReactionsStack::InvokeBackupQueue() void CustomElementReactionsStack::InvokeReactions(ElementQueue& aElementQueue) { + // Note: It's possible to re-enter this method. for (uint32_t i = 0; i < aElementQueue.Length(); ++i) { nsCOMPtr element = do_QueryReferent(aElementQueue[i]); @@ -984,10 +985,14 @@ CustomElementReactionsStack::InvokeReactions(ElementQueue& aElementQueue) RefPtr elementData = element->GetCustomElementData(); MOZ_ASSERT(elementData, "CustomElementData should exist"); - nsTArray>& reactions = - elementData->mReactionQueue; + auto& reactions = elementData->mReactionQueue; for (uint32_t j = 0; j < reactions.Length(); ++j) { - reactions.ElementAt(j)->Invoke(element); + // Transfer the ownership of the entry due to reentrant invocation of + // this funciton. The entry will be removed when bug 1379573 is landed. + auto reaction(Move(reactions.ElementAt(j))); + if (reaction) { + reaction->Invoke(element); + } } reactions.Clear(); } -- cgit v1.2.3