Get RefPtr to transaction before using it. (DiD)

Avoid potential use-after-free by getting a RefPtr to a transaction
before calling content code that could cause its de-allocation.
This commit is contained in:
wolfbeast 2019-02-07 12:39:42 +01:00 committed by Roy Tam
commit 183aae036f

View file

@ -3456,6 +3456,8 @@ BackgroundCursorChild::RecvResponse(const CursorResponse& aResponse)
RefPtr<IDBCursor> cursor;
mStrongCursor.swap(cursor);
RefPtr<IDBTransaction> transaction = mTransaction;
switch (aResponse.type()) {
case CursorResponse::Tnsresult:
@ -3486,7 +3488,7 @@ BackgroundCursorChild::RecvResponse(const CursorResponse& aResponse)
MOZ_CRASH("Should never get here!");
}
mTransaction->OnRequestFinished(/* aActorDestroyedNormally */ true);
transaction->OnRequestFinished(/* aActorDestroyedNormally */ true);
return true;
}