Bug 1376931 Part 4: Before MediaQueryList iteration for event listeners, copy the array before sending any events.
MozReview-Commit-ID: 4eDs6viuxvT
--- a/layout/base/nsPresContext.cpp
+++ b/layout/base/nsPresContext.cpp
@@ -2112,17 +2112,26 @@ nsPresContext::MediaFeatureValuesChanged
// flushes. (We're already running off an event.)
//
// Note that we do this after the new style from media queries in
// style sheets has been computed.
if (!mDocument->MediaQueryLists().isEmpty()) {
// We build a list of all the notifications we're going to send
// before we send any of them.
- for (auto mql : mDocument->MediaQueryLists()) {
+
+ // Copy pointers to all the lists into a new array, in case one of our
+ // notifications modifies the list.
+ nsTArray<RefPtr<mozilla::dom::MediaQueryList>> localMediaQueryLists;
+ for (auto* mql : mDocument->MediaQueryLists()) {
+ localMediaQueryLists.AppendElement(mql);
+ }
+
+ // Now iterate our local array of the lists.
+ for (const auto& mql : localMediaQueryLists) {
nsAutoMicroTask mt;
mql->MaybeNotify();
}
}
}
void
nsPresContext::PostMediaFeatureValuesChangedEvent()