From 931b14f84733918741caa377fb1777c494296d33 Mon Sep 17 00:00:00 2001
From: Gaming4JC <g4jc@hyperbola.info>
Date: Sat, 4 Jan 2020 22:05:07 -0500
Subject: [PATCH] Bug 1315885 - Part 3: Transfer the ownership of
 ReactionQueue's entry due to re-enter
 CustomElementReactionsStack::InvokeReactions.

Tag UXP Issue #1344
---
 dom/base/CustomElementRegistry.cpp | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/dom/base/CustomElementRegistry.cpp b/dom/base/CustomElementRegistry.cpp
index 249162c380..6419c1425b 100644
--- a/dom/base/CustomElementRegistry.cpp
+++ b/dom/base/CustomElementRegistry.cpp
@@ -974,6 +974,7 @@ CustomElementReactionsStack::InvokeBackupQueue()
 void
 CustomElementReactionsStack::InvokeReactions(ElementQueue& aElementQueue)
 {
+  // Note: It's possible to re-enter this method.
   for (uint32_t i = 0; i < aElementQueue.Length(); ++i) {
     nsCOMPtr<Element> element = do_QueryReferent(aElementQueue[i]);
 
@@ -984,10 +985,14 @@ CustomElementReactionsStack::InvokeReactions(ElementQueue& aElementQueue)
     RefPtr<CustomElementData> elementData = element->GetCustomElementData();
     MOZ_ASSERT(elementData, "CustomElementData should exist");
 
-    nsTArray<nsAutoPtr<CustomElementReaction>>& reactions =
-      elementData->mReactionQueue;
+    auto& reactions = elementData->mReactionQueue;
     for (uint32_t j = 0; j < reactions.Length(); ++j) {
-      reactions.ElementAt(j)->Invoke(element);
+      // Transfer the ownership of the entry due to reentrant invocation of
+      // this funciton. The entry will be removed when bug 1379573 is landed.
+      auto reaction(Move(reactions.ElementAt(j)));
+      if (reaction) {
+        reaction->Invoke(element);
+      }
     }
     reactions.Clear();
   }