Bug 1594147 - prevent possible null dereference in MaybeDispatchPrematureAbortEvents, r=smaug
authorJunior Hsu <juhsu@mozilla.com>
Fri, 08 Nov 2019 22:28:07 +0000
changeset 501400 d822ee62d62ae35d921339d051534ccc5af4b07e
parent 501399 a79182facdfb66acc72c0be720c8543978d2af5d
child 501401 038ebfdd141acdc7603d2378a832a572bb267686
push id36791
push usercsabou@mozilla.com
push dateSun, 10 Nov 2019 09:53:30 +0000
treeherdermozilla-central@72c52c0101cf [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssmaug
bugs1594147
milestone72.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1594147 - prevent possible null dereference in MaybeDispatchPrematureAbortEvents, r=smaug Differential Revision: https://phabricator.services.mozilla.com/D52409
dom/xhr/XMLHttpRequestWorker.cpp
--- a/dom/xhr/XMLHttpRequestWorker.cpp
+++ b/dom/xhr/XMLHttpRequestWorker.cpp
@@ -1524,16 +1524,22 @@ void XMLHttpRequestWorker::MaybeDispatch
     }
 
     DispatchPrematureAbortEvent(mUpload, NS_LITERAL_STRING("loadend"), true,
                                 aRv);
     if (aRv.Failed()) {
       return;
     }
 
+    // Similarly to null check in ::Open, mProxy may have been cleared here.
+    if (!mProxy) {
+      aRv.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
+      return;
+    }
+
     mProxy->mSeenUploadLoadStart = false;
   }
 
   if (mProxy->mSeenLoadStart) {
     if (isStateChanged) {
       DispatchPrematureAbortEvent(this, NS_LITERAL_STRING("readystatechange"),
                                   false, aRv);
       if (aRv.Failed()) {