From 8ea599da166c3db42daf1e237c0f2af6fe8a96b6 Mon Sep 17 00:00:00 2001
From: Henri Sivonen <hsivonen@hsivonen.fi>
Date: Wed, 30 Nov 2022 16:57:02 +0000
Subject: [PATCH] Bug 1803317 - Assert that mOpQueue is empty in
 ~nsHtml5TreeOpExecutor. r=edgar

The purpose is to be alerted of cases when ops were supposed to execute
but did not.

Differential Revision: https://phabricator.services.mozilla.com/D163425
---
 parser/html/nsHtml5TreeOpExecutor.cpp | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/parser/html/nsHtml5TreeOpExecutor.cpp b/parser/html/nsHtml5TreeOpExecutor.cpp
index e329f50828aa..a09f98a73f4f 100644
--- a/parser/html/nsHtml5TreeOpExecutor.cpp
+++ b/parser/html/nsHtml5TreeOpExecutor.cpp
@@ -141,16 +141,8 @@ nsHtml5TreeOpExecutor::~nsHtml5TreeOpExecutor() {
       }
     }
   }
-  // We used to have an `NS_ASSERTION` here that asserted
-  // that either `mBroken` is true or `mOpQueue` is empty.
-  // Sometimes a tree op executor ended up being cycle collected
-  // with the assertion firing. It is not understood what
-  // code path abandons an instance of the tree op executor
-  // without terminating it so that the cycle collector sees
-  // it with stuff still in the queue. The assertion was removed
-  // to avoid sheriffing the assertion failure without a path
-  // to understanding how the object gets abandoned to cycle
-  // collection.
+  MOZ_ASSERT(NS_FAILED(mBroken) || mOpQueue.IsEmpty(),
+             "Somehow there's stuff in the op queue.");
 }
 
 // nsIContentSink
@@ -181,6 +173,13 @@ nsHtml5TreeOpExecutor::DidBuildModel(bool aTerminated) {
   MOZ_RELEASE_ASSERT(!IsInDocUpdate(),
                      "DidBuildModel from inside a doc update.");
 
+  RefPtr<nsHtml5TreeOpExecutor> pin(this);
+  auto queueClearer = MakeScopeExit([&] {
+    if (aTerminated && (mFlushState == eNotFlushing)) {
+      ClearOpQueue();  // clear in order to be able to assert in destructor
+    }
+  });
+
   // This comes from nsXMLContentSink and nsHTMLContentSink
   // If this parser has been marked as broken, treat the end of parse as
   // forced termination.