tor-browser

commit 5a4bd014b71c3b6801f11a9b2367d874c94846fb
parent 384a8b869eaf73a42dc6769aa361b9e0458f0301
Author: Henri Sivonen <hsivonen@hsivonen.fi>
Date:   Wed, 10 Dec 2025 15:23:14 +0000

Bug 2004500 - Clear the op queue when terminating early. r=dom-core,smaug

Differential Revision: https://phabricator.services.mozilla.com/D275791

Diffstat:
M
parser/html/nsHtml5TreeOpExecutor.cpp
 | 
5
+++++

1 file changed, 5 insertions(+), 0 deletions(-)
diff --git a/parser/html/nsHtml5TreeOpExecutor.cpp b/parser/html/nsHtml5TreeOpExecutor.cpp
@@ -117,6 +117,7 @@ class MOZ_RAII nsHtml5AutoFlush final {
                "wasn't less than the length of the queue.");
     mOpsToRemove = aOpsToRemove;
   }
+  void RequestRemovalOfAllOps() { mOpsToRemove = mExecutor->OpQueueLength(); }
 };
 
 static LinkedList<nsHtml5TreeOpExecutor>* gBackgroundFlushList = nullptr;
@@ -679,6 +680,8 @@ void nsHtml5TreeOpExecutor::RunFlushLoop() {
 
       if (MOZ_UNLIKELY(!mParser)) {
         // The parse ended during an update pause.
+        // Undo possible previous `SetNumberOfOpsToRemove` call.
+        autoFlush.RequestRemovalOfAllOps();
         return;
       }
       if (streamEnded) {
@@ -789,6 +792,8 @@ nsresult nsHtml5TreeOpExecutor::FlushDocumentWrite() {
 
     if (MOZ_UNLIKELY(!mParser)) {
       // The parse ended during an update pause.
+      // No need to call `autoFlush.RequestRemovalOfAllOps();`, because there is
+      // no `SetNumberOfOpsToRemove` call.
       return rv;
     }
     if (streamEnded) {