Bug 1546185 - Also check mEventDispatchingSuspended to see if we are in sync event loop r=baku
authorKershaw Chang <kershaw@mozilla.com>
Tue, 01 Oct 2019 11:31:43 +0000
changeset 495793 b24092b7bd4989e85494022922d766d120536cf2
parent 495792 d99346c1efd680eb47a080522ec9e82224d5433d
child 495794 73a76edb175f07d1160d35627cd0ca8bf8bd6d53
push id114140
push userdvarga@mozilla.com
push dateWed, 02 Oct 2019 18:04:51 +0000
treeherdermozilla-inbound@32eb0ea893f3 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbaku
bugs1546185
milestone71.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1546185 - Also check mEventDispatchingSuspended to see if we are in sync event loop r=baku Only useing `mFlagSyncLooping` to check if the current code is in sync event loop is not enough. The crashtest in this patch shows that `mFlagSyncLooping` is set to false in OnStopReequets while we are still in sync event loop. `mEventDispatchingSuspended` is set to true right before calling `SpinEventLoopUntil` and set to false after, so we should also use it to check if `SpinEventLoopUntil` is finished. Differential Revision: https://phabricator.services.mozilla.com/D47240
dom/xhr/XMLHttpRequestMainThread.cpp
dom/xhr/tests/crashtests/1546185.html
dom/xhr/tests/crashtests/crashtests.list
testing/crashtest/crashtests.list
--- a/dom/xhr/XMLHttpRequestMainThread.cpp
+++ b/dom/xhr/XMLHttpRequestMainThread.cpp
@@ -173,22 +173,22 @@ static void AddLoadFlags(nsIRequest* req
   nsLoadFlags flags;
   request->GetLoadFlags(&flags);
   flags |= newFlags;
   request->SetLoadFlags(flags);
 }
 
 // We are in a sync event loop.
 #define NOT_CALLABLE_IN_SYNC_SEND                              \
-  if (mFlagSyncLooping) {                                      \
+  if (mFlagSyncLooping || mEventDispatchingSuspended) {        \
     return NS_ERROR_DOM_INVALID_STATE_XHR_HAS_INVALID_CONTEXT; \
   }
 
 #define NOT_CALLABLE_IN_SYNC_SEND_RV                               \
-  if (mFlagSyncLooping) {                                          \
+  if (mFlagSyncLooping || mEventDispatchingSuspended) {            \
     aRv.Throw(NS_ERROR_DOM_INVALID_STATE_XHR_HAS_INVALID_CONTEXT); \
     return;                                                        \
   }
 
 /////////////////////////////////////////////
 //
 //
 /////////////////////////////////////////////
new file mode 100644
--- /dev/null
+++ b/dom/xhr/tests/crashtests/1546185.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom() {
+  a = new AudioContext();
+  b = new XMLHttpRequest({});
+  c = new ArrayBuffer(34464);
+  d = new XMLHttpRequest();
+  try {
+    d.open('G', '', false);
+  } catch (e) {}
+  try {
+    x = new ArrayBuffer(1);
+    a.decodeAudioData(x, function() {}, function() {
+      try {
+        b.open('G', '', false);
+      } catch (e) {}
+      try {
+        b.send();
+      } catch (e) {}
+      try {
+        d.open('P', '', false);
+      } catch (e) {}
+      try {
+        d.send();
+      } catch (e) {}
+    })
+  } catch (e) {}
+  try {
+    d.send();
+  } catch (e) {}
+}
+
+boom();
+
+</script>
+</head>
+<body></body>
+</html>
new file mode 100644
--- /dev/null
+++ b/dom/xhr/tests/crashtests/crashtests.list
@@ -0,0 +1,1 @@
+load 1546185.html
--- a/testing/crashtest/crashtests.list
+++ b/testing/crashtest/crashtests.list
@@ -24,16 +24,17 @@ include ../../dom/media/test/crashtests/
 skip-if(!webrtc) include ../../dom/media/tests/crashtests/crashtests.list
 include ../../dom/media/webspeech/synth/crashtests/crashtests.list
 include ../../dom/offline/crashtests/crashtests.list
 include ../../dom/plugins/test/crashtests/crashtests.list
 include ../../dom/smil/crashtests/crashtests.list
 include ../../dom/svg/crashtests/crashtests.list
 include ../../dom/workers/test/crashtests/crashtests.list
 include ../../dom/xbl/crashtests/crashtests.list
+include ../../dom/xhr/tests/crashtests/crashtests.list
 include ../../dom/xml/crashtests/crashtests.list
 include ../../dom/xslt/crashtests/crashtests.list
 include ../../dom/xul/crashtests/crashtests.list
 
 include ../../editor/composer/crashtests/crashtests.list
 include ../../editor/libeditor/crashtests/crashtests.list
 include ../../editor/txmgr/tests/crashtests/crashtests.list