Bug 1455819 - Crash in nsGlobalWindowInner::CallOnChildren<T>, r=nika
authorOlli Pettay <Olli.Pettay@helsinki.fi>
Mon, 30 Apr 2018 21:02:15 +0300
changeset 472488 c80d4798b4e1c5211917f54286a32c387b21af99
parent 472487 f3cd454b519705b20bd46636ca0b3c50bc941778
child 472489 86e39351c774595b13f108836b002b0f8e947a52
push id1728
push userjlund@mozilla.com
push dateMon, 18 Jun 2018 21:12:27 +0000
treeherdermozilla-release@c296fde26f5f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnika
bugs1455819
milestone61.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1455819 - Crash in nsGlobalWindowInner::CallOnChildren<T>, r=nika
dom/base/nsGlobalWindowInner.cpp
--- a/dom/base/nsGlobalWindowInner.cpp
+++ b/dom/base/nsGlobalWindowInner.cpp
@@ -6285,21 +6285,28 @@ nsGlobalWindowInner::CallOnChildren(Meth
   nsCOMPtr<nsIDocShell> docShell = GetDocShell();
   if (!docShell) {
     return state;
   }
 
   int32_t childCount = 0;
   docShell->GetChildCount(&childCount);
 
+  // Take a copy of the current children so that modifications to
+  // the child list don't affect to the iteration.
+  AutoTArray<nsCOMPtr<nsIDocShellTreeItem>, 8> children;
   for (int32_t i = 0; i < childCount; ++i) {
     nsCOMPtr<nsIDocShellTreeItem> childShell;
     docShell->GetChildAt(i, getter_AddRefs(childShell));
-    NS_ASSERTION(childShell, "null child shell");
-
+    if (childShell) {
+      children.AppendElement(childShell);
+    }
+  }
+
+  for (nsCOMPtr<nsIDocShellTreeItem> childShell : children) {
     nsCOMPtr<nsPIDOMWindowOuter> pWin = childShell->GetWindow();
     if (!pWin) {
       continue;
     }
 
     auto* win = nsGlobalWindowOuter::Cast(pWin);
     nsGlobalWindowInner* inner = win->GetCurrentInnerWindowInternal();
 
@@ -6426,21 +6433,28 @@ nsGlobalWindowInner::FireDelayedDOMEvent
     ScheduleActiveTimerCallback();
   }
 
   nsCOMPtr<nsIDocShell> docShell = GetDocShell();
   if (docShell) {
     int32_t childCount = 0;
     docShell->GetChildCount(&childCount);
 
+    // Take a copy of the current children so that modifications to
+    // the child list don't affect to the iteration.
+    AutoTArray<nsCOMPtr<nsIDocShellTreeItem>, 8> children;
     for (int32_t i = 0; i < childCount; ++i) {
       nsCOMPtr<nsIDocShellTreeItem> childShell;
       docShell->GetChildAt(i, getter_AddRefs(childShell));
-      NS_ASSERTION(childShell, "null child shell");
-
+      if (childShell) {
+        children.AppendElement(childShell);
+      }
+    }
+
+    for (nsCOMPtr<nsIDocShellTreeItem> childShell : children) {
       if (nsCOMPtr<nsPIDOMWindowOuter> pWin = childShell->GetWindow()) {
         auto* win = nsGlobalWindowOuter::Cast(pWin);
         win->FireDelayedDOMEvents();
       }
     }
   }
 
   return NS_OK;