From 0efbc454b61905aeaad411f50b99e975fbb54064 Mon Sep 17 00:00:00 2001
From: Martok <martok@martoks-place.de>
Date: Sun, 14 Jan 2024 21:53:12 +0100
Subject: [PATCH] Issue #2452 - Fire events after iterating
 ServiceWorkerManager::mControlledDocuments is done.

https://bugzilla.mozilla.org/show_bug.cgi?id=1413466
---
 dom/workers/ServiceWorkerManager.cpp | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/dom/workers/ServiceWorkerManager.cpp b/dom/workers/ServiceWorkerManager.cpp
index 0bea0223f8..7f70c9ee10 100644
--- a/dom/workers/ServiceWorkerManager.cpp
+++ b/dom/workers/ServiceWorkerManager.cpp
@@ -3082,6 +3082,8 @@ void
 ServiceWorkerManager::FireControllerChange(ServiceWorkerRegistrationInfo* aRegistration)
 {
   AssertIsOnMainThread();
+
+  AutoTArray<nsCOMPtr<nsIDocument>, 16> documents;
   for (auto iter = mControlledDocuments.Iter(); !iter.Done(); iter.Next()) {
     if (iter.UserData() != aRegistration) {
       continue;
@@ -3092,6 +3094,12 @@ ServiceWorkerManager::FireControllerChange(ServiceWorkerRegistrationInfo* aRegis
       continue;
     }
 
+    documents.AppendElement(doc);
+  }
+  
+  // Fire event after iterating mControlledDocuments is done to prevent
+  // modification by reentering from the event handlers during iteration.
+  for (auto& doc : documents) {
     FireControllerChangeOnDocument(doc);
   }
 }