Bug 1521510 - Keep a reference to the document in PaymentRequest. r=qdot

The current document of a window can change in between the time when a
PaymentRequest registers as an activity observer and when it attempts
to unregister, so keep a strong reference to the document. This is the
same issue as bug 1317805.

Differential Revision: https://phabricator.services.mozilla.com/D17540

--HG--
extra : moz-landing-system : lando

dom/payments/PaymentRequest.cpp

@@ -43,6 +43,7 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(PaymentRequest,
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mResponse)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mShippingAddress)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mFullShippingAddress)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDocument)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(PaymentRequest,
@@ -53,6 +54,8 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(PaymentRequest,
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mResponse)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mShippingAddress)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mFullShippingAddress)
+  tmp->UnregisterActivityObserver();
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mDocument)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(PaymentRequest)
@@ -1137,21 +1140,18 @@ bool PaymentRequest::InFullyActiveDocument() {
 
 void PaymentRequest::RegisterActivityObserver() {
   if (nsPIDOMWindowInner* window = GetOwner()) {
-    nsCOMPtr<Document> doc = window->GetExtantDoc();
-    if (doc) {
-      doc->RegisterActivityObserver(
+    mDocument = window->GetExtantDoc();
+    if (mDocument) {
+      mDocument->RegisterActivityObserver(
           NS_ISUPPORTS_CAST(nsIDocumentActivity*, this));
     }
   }
 }
 
 void PaymentRequest::UnregisterActivityObserver() {
-  if (nsPIDOMWindowInner* window = GetOwner()) {
-    nsCOMPtr<Document> doc = window->GetExtantDoc();
-    if (doc) {
-      doc->UnregisterActivityObserver(
-          NS_ISUPPORTS_CAST(nsIDocumentActivity*, this));
-    }
+  if (mDocument) {
+    mDocument->UnregisterActivityObserver(
+        NS_ISUPPORTS_CAST(nsIDocumentActivity*, this));
   }
 }
 

dom/payments/PaymentRequest.h

@@ -250,6 +250,9 @@ class PaymentRequest final : public DOMEventTargetHelper,
   RefPtr<PaymentAddress> mShippingAddress;
   // The full shipping address to be used in the response upon payment.
   RefPtr<PaymentAddress> mFullShippingAddress;
+  // Hold a reference to the document to allow unregistering the activity
+  // observer.
+  RefPtr<Document> mDocument;
   // It is populated when the user chooses a shipping option.
   nsString mShippingOption;