diff options
| author | Gaming4JC <g4jc@hyperbola.info> | 2020-01-05 10:31:42 -0500 |
|---|---|---|
| committer | Gaming4JC <g4jc@hyperbola.info> | 2020-01-26 15:50:23 -0500 |
| commit | d7e5ad445cc8cb3f3f04e7c177350fcf1c12c62f (patch) | |
| tree | c5a20606c673e9509a8354bdbcaf17c18fab991b /dom/base/CustomElementRegistry.h | |
| parent | ca596f2823f90c1416db8a317ac8eb22c9119bbf (diff) | |
| download | uxp-d7e5ad445cc8cb3f3f04e7c177350fcf1c12c62f.tar.gz | |
Bug 1299363 - Part 4: Hold a pointer of ElementQueue in ReactionsStack instead.
1. It is possible that invoking a reaction triggers pushing a new ElementQueue into ReactionStack (e.g., calling define() in constructor which probably enqueue another upgrade reaction), and the reference of ElementQueue passed to InvokeReactions becomes invalid due to the memmove in nsTArray implementation.
2. And we get another benefit from this is memmove becomes faster.
Tag UXP Issue #1344
Diffstat (limited to 'dom/base/CustomElementRegistry.h')
| -rw-r--r-- | dom/base/CustomElementRegistry.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/dom/base/CustomElementRegistry.h b/dom/base/CustomElementRegistry.h index db208bf713..620492cbb7 100644 --- a/dom/base/CustomElementRegistry.h +++ b/dom/base/CustomElementRegistry.h @@ -247,7 +247,7 @@ private: ~CustomElementReactionsStack() {}; // The choice of 8 for the auto size here is based on gut feeling. - AutoTArray<ElementQueue, 8> mReactionsStack; + AutoTArray<UniquePtr<ElementQueue>, 8> mReactionsStack; ElementQueue mBackupQueue; // https://html.spec.whatwg.org/#enqueue-an-element-on-the-appropriate-element-queue bool mIsBackupQueueProcessing; @@ -258,7 +258,7 @@ private: * Invoke custom element reactions * https://html.spec.whatwg.org/multipage/scripting.html#invoke-custom-element-reactions */ - void InvokeReactions(ElementQueue& aElementQueue); + void InvokeReactions(ElementQueue* aElementQueue); void Enqueue(Element* aElement, CustomElementReaction* aReaction); |