Bug 1564821 - Response must call JS::ReadableStreamReleaseCCObject() if ::GetBody() fails, r=smaug

Differential Revision: https://phabricator.services.mozilla.com/D37711

--HG--
extra : moz-landing-system : lando

dom/base/BodyStream.h

@@ -47,6 +47,16 @@ class BodyStream final : public nsIInputStreamCallback,
   NS_DECL_NSIINPUTSTREAMCALLBACK
   NS_DECL_NSIOBSERVER
 
+  // This method creates a JS ReadableStream object and it makes a CC cycle
+  // between it and the aStreamHolder.
+  // The aStreamHolder must do the following operations after calling this
+  // method:
+  // - it must store the JS ReadableStream and returns it in
+  //   BodyStreamHolder::GetReadableStreamBody().
+  // - it must trace the JS ReadableStream.
+  // - if the operation has to be aborted, or the stream has to be released for
+  //   any reason, the aStreamHolder must call
+  //   JS::ReadableStreamReleaseCCObject().
   static void Create(JSContext* aCx, BodyStreamHolder* aStreamHolder,
                      nsIGlobalObject* aGlobal, nsIInputStream* aInputStream,
                      JS::MutableHandle<JSObject*> aStream, ErrorResult& aRv);

dom/fetch/Fetch.cpp

@@ -1328,6 +1328,11 @@ void FetchBody<Derived>::GetBody(JSContext* aCx,
 
   MOZ_ASSERT(body);
 
+  // We must break the cycle between the body and the stream in case we do an
+  // early return.
+  auto raii =
+      mozilla::MakeScopeExit([&] { JS::ReadableStreamReleaseCCObject(body); });
+
   // If the body has been already consumed, we lock the stream.
   bool bodyUsed = GetBodyUsed(aRv);
   if (NS_WARN_IF(aRv.Failed())) {
@@ -1352,6 +1357,8 @@ void FetchBody<Derived>::GetBody(JSContext* aCx,
     }
   }
 
+  raii.release();
+
   mReadableStreamBody = body;
   aBodyOut.set(mReadableStreamBody);
 }