From eac19e335655e462c5a100b64d9016094cdbe34a Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Fri, 16 Oct 2020 10:19:19 +0000
Subject: Issue #1643 - Follow-up: Ensure we properly clear our pointers when
 the Presentation of a document is destroyed.

---
 dom/base/ResizeObserverController.cpp | 22 +++++++++++++---------
 dom/base/ResizeObserverController.h   |  5 +++++
 dom/base/nsDocument.cpp               |  6 ++++++
 3 files changed, 24 insertions(+), 9 deletions(-)

(limited to 'dom/base')

diff --git a/dom/base/ResizeObserverController.cpp b/dom/base/ResizeObserverController.cpp
index d4166155e..edf73fc73 100644
--- a/dom/base/ResizeObserverController.cpp
+++ b/dom/base/ResizeObserverController.cpp
@@ -16,7 +16,7 @@ namespace dom {
 void
 ResizeObserverNotificationHelper::WillRefresh(TimeStamp aTime)
 {
-  MOZ_ASSERT(mOwner, "Why is mOwner already dead when this RefreshObserver is still registered?");
+  MOZ_DIAGNOSTIC_ASSERT(mOwner, "RefreshObserver should have been de-registered on time, but isn't.");
   if (mOwner) {
     mOwner->Notify();
   }
@@ -70,10 +70,8 @@ ResizeObserverNotificationHelper::Unregister()
   }
 
   nsRefreshDriver* refreshDriver = GetRefreshDriver();
-  if (!refreshDriver) {
-    // We can't access RefreshDriver now. Just abort the Unregister().
-    return;
-  }
+  MOZ_RELEASE_ASSERT(refreshDriver,
+                     "We should not leave a dangling reference to the observer around");
 
   refreshDriver->RemoveRefreshObserver(this, Flush_Display);
   mRegistered = false;
@@ -82,9 +80,8 @@ ResizeObserverNotificationHelper::Unregister()
 void
 ResizeObserverNotificationHelper::Disconnect()
 {
-  Unregister();
-  // Our owner is dying. Clear our pointer to it, in case we outlive it.
-  mOwner = nullptr;
+  MOZ_RELEASE_ASSERT(!mRegistered, "How can we die when registered?");
+  MOZ_RELEASE_ASSERT(!mOwner, "Forgot to clear weak pointer?");
 }
 
 ResizeObserverNotificationHelper::~ResizeObserverNotificationHelper()
@@ -112,6 +109,10 @@ ResizeObserverController::AddResizeObserver(ResizeObserver* aObserver)
   mResizeObservers.AppendElement(aObserver);
 }
 
+void ResizeObserverController::DetachFromDocument() {
+  mResizeObserverNotificationHelper->Unregister();
+}
+
 void
 ResizeObserverController::Notify()
 {
@@ -241,7 +242,10 @@ ResizeObserverController::GetShell() const
 
 ResizeObserverController::~ResizeObserverController()
 {
-  mResizeObserverNotificationHelper->Disconnect();
+  MOZ_RELEASE_ASSERT(
+      !mResizeObserverNotificationHelper->IsRegistered(),
+      "Nothing else should keep a reference to our notification helper when we go away");
+  mResizeObserverNotificationHelper->DetachFromOwner();
 }
 
 } // namespace dom
diff --git a/dom/base/ResizeObserverController.h b/dom/base/ResizeObserverController.h
index a77511587..2ddfc958c 100644
--- a/dom/base/ResizeObserverController.h
+++ b/dom/base/ResizeObserverController.h
@@ -42,6 +42,10 @@ public:
 
   void Disconnect();
 
+  bool IsRegistered() const { return mRegistered; }
+
+  void DetachFromOwner() { mOwner = nullptr; }
+
 protected:
   virtual ~ResizeObserverNotificationHelper();
 
@@ -69,6 +73,7 @@ public:
   void Traverse(nsCycleCollectionTraversalCallback& aCb);
   void Unlink();
 
+  void DetachFromDocument();
   void AddResizeObserver(ResizeObserver* aObserver);
 
   /*
diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
index 0b07ef4ec..144f048eb 100644
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -3689,6 +3689,12 @@ nsDocument::DeleteShell()
   // objects for @font-face rules that came from the style set.
   RebuildUserFontSet();
 
+  if (mResizeObserverController) {
+    // If the shell is going away, we need to remove any links to this document
+    // from the observer.
+    mResizeObserverController->DetachFromDocument();
+  }
+
   nsIPresShell* oldShell = mPresShell;
   mPresShell = nullptr;
   UpdateFrameRequestCallbackSchedulingState(oldShell);
-- 
cgit v1.2.3