tor-browser

commit eb3b82005828ac063913d3de6ba897beb64b06d7
parent 23b228e545bc3a1cebab376dc78ae82f3e552f67
Author: Jan-Niklas Jaeschke <jjaschke@mozilla.com>
Date:   Fri, 17 Oct 2025 11:31:03 +0000

Bug 1994977 - Navigation API: Clear `mOngoingNavigateEvent` in every code path of the inner event firing algorithm. r=farre

Differential Revision: https://phabricator.services.mozilla.com/D269032

Diffstat:
M
dom/navigation/Navigation.cpp
 | 
6
++++++

1 file changed, 6 insertions(+), 0 deletions(-)
diff --git a/dom/navigation/Navigation.cpp b/dom/navigation/Navigation.cpp
@@ -1583,6 +1583,12 @@ bool Navigation::InnerFireNavigateEvent(
     MOZ_DIAGNOSTIC_ASSERT(apiMethodTracker == mOngoingAPIMethodTracker);
     // Step 35
     apiMethodTracker->CleanUp();
+  } else {
+    // It needs to be ensured that the ongoing navigate event is cleared in
+    // every code path (e.g. for download events), so that we don't keep
+    // intermediate state around.
+    // See also https://github.com/whatwg/html/issues/11802
+    mOngoingNavigateEvent = nullptr;
   }
 
   // Step 37 and step 38