tor-browser

commit bffa28e28fdbcdf0fc1d72465c4dd27244565450
parent 32ca1b874763b5f32c975d2c91f23ade5a04d595
Author: Henri Sivonen <hsivonen@hsivonen.fi>
Date:   Thu,  2 Oct 2025 09:53:05 +0000

Bug 1863177 - Avoid a release assert when speculative load flush is attempted from a nested event loop. r=smaug

Differential Revision: https://phabricator.services.mozilla.com/D267169

Diffstat:
M
parser/html/nsHtml5StreamParser.cpp
 | 
6
+++++-
M
parser/html/nsHtml5TreeOpExecutor.cpp
 | 
2
++

2 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/parser/html/nsHtml5StreamParser.cpp b/parser/html/nsHtml5StreamParser.cpp
@@ -172,7 +172,11 @@ class nsHtml5LoadFlusher : public Runnable {
   explicit nsHtml5LoadFlusher(nsHtml5TreeOpExecutor* aExecutor)
       : Runnable("nsHtml5LoadFlusher"), mExecutor(aExecutor) {}
   NS_IMETHOD Run() override {
-    mExecutor->FlushSpeculativeLoads();
+    // If we're in sync XHR, do nothing. We'll flush the speculative loads
+    // after the flush ends.
+    if (!mExecutor->IsFlushing()) {
+      mExecutor->FlushSpeculativeLoads();
+    }
     return NS_OK;
   }
 };
diff --git a/parser/html/nsHtml5TreeOpExecutor.cpp b/parser/html/nsHtml5TreeOpExecutor.cpp
@@ -108,6 +108,8 @@ class MOZ_RAII nsHtml5AutoFlush final {
     }
     mExecutor->EndFlush();
     mExecutor->RemoveFromStartOfOpQueue(mOpsToRemove);
+    // We might have missed a speculative load flush due to sync XHR
+    mExecutor->FlushSpeculativeLoads();
   }
   void SetNumberOfOpsToRemove(size_t aOpsToRemove) {
     MOZ_ASSERT(aOpsToRemove < mOpsToRemove,