#600: M1588248 M1614704

classilla · Apr 30, 2020 · 03e03bd · 03e03bd
1 parent 5bb1c76
commit 03e03bd
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 5 deletions.
diff --git a/dom/workers/XMLHttpRequest.cpp b/dom/workers/XMLHttpRequest.cpp
@@ -1861,6 +1861,8 @@ XMLHttpRequest::SendInternal(SendRunnable* aRunnable,
   aRunnable->SetSyncLoopTarget(syncLoopTarget);
   aRunnable->SetHaveUploadListeners(hasUploadListeners);
 
+  mStateData.mFlagSend = true;
+
   if (!aRunnable->Dispatch(cx)) {
     // Dispatch() may have spun the event loop and we may have already unrooted.
     // If so we don't want autoUnpin to try again.
@@ -1879,7 +1881,11 @@ XMLHttpRequest::SendInternal(SendRunnable* aRunnable,
 
   autoUnpin.Clear();
 
-  if (!autoSyncLoop->Run()) {
+  bool succeeded = autoSyncLoop->Run();
+  mStateData.mFlagSend = false;
+
+  if (!succeeded) {
+    // Somehow we didn't throw. Throw now.
     aRv.Throw(NS_ERROR_FAILURE);
   }
 }
@@ -2083,7 +2089,7 @@ XMLHttpRequest::Send(ErrorResult& aRv)
     return;
   }
 
-  if (!mProxy) {
+  if (!mProxy || mStateData.mFlagSend) {
     aRv.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
     return;
   }

diff --git a/dom/workers/XMLHttpRequest.h b/dom/workers/XMLHttpRequest.h
@@ -44,11 +44,12 @@ class XMLHttpRequest final: public nsXHREventTarget,
     nsresult mResponseTextResult;
     nsresult mStatusResult;
     nsresult mResponseResult;
+    bool mFlagSend; // TenFourFox issue 600 (backbugs for M1588248)
 
     StateData()
     : mStatus(0), mReadyState(0), mResponse(JS::UndefinedValue()),
       mResponseTextResult(NS_OK), mStatusResult(NS_OK),
-      mResponseResult(NS_OK)
+      mResponseResult(NS_OK), mFlagSend(false)
     { }
   };
 

diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
@@ -4737,9 +4737,10 @@ class MCreateThis
         return getOperand(0);
     }
 
-    // Although creation of |this| modifies global state, it is safely repeatable.
+    // Performs a property read from |newTarget| iff |newTarget| is a JSFunction
+    // with an own |.prototype| property.
     AliasSet getAliasSet() const override {
-        return AliasSet::None();
+        return AliasSet::Load(AliasSet::Any);
     }
     bool possiblyCalls() const override {
         return true;