Bug 1376931 Part 4: Before MediaQueryList iteration for event listeners, copy the array before sending any events. draft
authorBrad Werth <bwerth@mozilla.com>
Tue, 19 Sep 2017 17:05:16 -0700
changeset 675305 0fd99b4f97673613300557a9b0d0b6504844c55b
parent 675304 d01d87223b630277c024e95e9a74d421bf39ce86
child 675306 8593aa2db777374af014e294eacffce383879be3
push id83098
push userbwerth@mozilla.com
push dateThu, 05 Oct 2017 04:35:10 +0000
bugs1376931
milestone58.0a1
Bug 1376931 Part 4: Before MediaQueryList iteration for event listeners, copy the array before sending any events. MozReview-Commit-ID: 4eDs6viuxvT
layout/base/nsPresContext.cpp
--- a/layout/base/nsPresContext.cpp
+++ b/layout/base/nsPresContext.cpp
@@ -2112,17 +2112,26 @@ nsPresContext::MediaFeatureValuesChanged
   // flushes.  (We're already running off an event.)
   //
   // Note that we do this after the new style from media queries in
   // style sheets has been computed.
 
   if (!mDocument->MediaQueryLists().isEmpty()) {
     // We build a list of all the notifications we're going to send
     // before we send any of them.
-    for (auto mql : mDocument->MediaQueryLists()) {
+
+    // Copy pointers to all the lists into a new array, in case one of our
+    // notifications modifies the list.
+    nsTArray<RefPtr<mozilla::dom::MediaQueryList>> localMediaQueryLists;
+    for (auto* mql : mDocument->MediaQueryLists()) {
+      localMediaQueryLists.AppendElement(mql);
+    }
+
+    // Now iterate our local array of the lists.
+    for (const auto& mql : localMediaQueryLists) {
       nsAutoMicroTask mt;
       mql->MaybeNotify();
     }
   }
 }
 
 void
 nsPresContext::PostMediaFeatureValuesChangedEvent()