From a8344b1f34cddfe18f7371f39e92145275655125 Mon Sep 17 00:00:00 2001 From: Jon Coppeard Date: Wed, 12 Oct 2022 16:26:20 +0000 Subject: [PATCH] Bug 1712762 - Check if module load requests have already been cancelled in ModuleLoaderBase::CancelDynamicImport r=yulia I don't know whether this is the problem, but if we try and cancel a request that has already been cancelled it would produce this crash. Differential Revision: https://phabricator.services.mozilla.com/D159167 --- js/loader/ModuleLoaderBase.cpp | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-) diff --git a/js/loader/ModuleLoaderBase.cpp b/js/loader/ModuleLoaderBase.cpp index 1432f059257b..2eb218d2d97a 100644 --- a/js/loader/ModuleLoaderBase.cpp +++ b/js/loader/ModuleLoaderBase.cpp @@ -1001,11 +1001,13 @@ void ModuleLoaderBase::CancelDynamicImport(ModuleLoadRequest* aRequest, MOZ_ASSERT(aRequest->mLoader == this); RefPtr req = mDynamicImportRequests.Steal(aRequest); - aRequest->Cancel(); - // FinishDynamicImport must happen exactly once for each dynamic import - // request. If the load is aborted we do it when we remove the request - // from mDynamicImportRequests. - FinishDynamicImportAndReject(aRequest, aResult); + if (!aRequest->IsCanceled()) { + aRequest->Cancel(); + // FinishDynamicImport must happen exactly once for each dynamic import + // request. If the load is aborted we do it when we remove the request + // from mDynamicImportRequests. + FinishDynamicImportAndReject(aRequest, aResult); + } } void ModuleLoaderBase::RemoveDynamicImport(ModuleLoadRequest* aRequest) { @@ -1245,15 +1247,10 @@ nsresult ModuleLoaderBase::EvaluateModuleInContext( } void ModuleLoaderBase::CancelAndClearDynamicImports() { - for (ScriptLoadRequest* req = mDynamicImportRequests.getFirst(); req; - req = req->getNext()) { - req->Cancel(); - // FinishDynamicImport must happen exactly once for each dynamic import - // request. If the load is aborted we do it when we remove the request - // from mDynamicImportRequests. - FinishDynamicImportAndReject(req->AsModuleRequest(), NS_ERROR_ABORT); + while (ScriptLoadRequest* req = mDynamicImportRequests.getFirst()) { + // This also removes the request from the list. + CancelDynamicImport(req->AsModuleRequest(), NS_ERROR_ABORT); } - mDynamicImportRequests.CancelRequestsAndClear(); } UniquePtr ModuleLoaderBase::ParseImportMap(