From de35243abb7fecff425742e8a708f4187d5cd34a Mon Sep 17 00:00:00 2001
From: Ben Kelly <ben@wanderview.com>
Date: Wed, 1 Feb 2017 06:43:58 -0800
Subject: [PATCH] Bug 1334677 Make PostMessageRunnable handle the port being
 cycle collected. r=baku

---
 dom/messagechannel/MessagePort.cpp | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/dom/messagechannel/MessagePort.cpp b/dom/messagechannel/MessagePort.cpp
index 7e7771e46c16..ac76ec9cbf64 100644
--- a/dom/messagechannel/MessagePort.cpp
+++ b/dom/messagechannel/MessagePort.cpp
@@ -63,7 +63,14 @@ public:
   NS_IMETHOD
   Run() override
   {
-    MOZ_ASSERT(mPort);
+    NS_ASSERT_OWNINGTHREAD(Runnable);
+
+    // The port can be cycle collected while this runnable is pending in
+    // the event queue.
+    if (!mPort) {
+      return NS_OK;
+    }
+
     MOZ_ASSERT(mPort->mPostMessageRunnable == this);
 
     nsresult rv = DispatchMessage();
@@ -81,6 +88,8 @@ public:
   nsresult
   Cancel() override
   {
+    NS_ASSERT_OWNINGTHREAD(Runnable);
+
     mPort = nullptr;
     mData = nullptr;
     return NS_OK;
@@ -90,6 +99,8 @@ private:
   nsresult
   DispatchMessage() const
   {
+    NS_ASSERT_OWNINGTHREAD(Runnable);
+
     nsCOMPtr<nsIGlobalObject> globalObject = mPort->GetParentObject();
 
     AutoJSAPI jsapi;