From 4e9aade4a5a5b70a5c291cfac8bc6956be28cdb9 Mon Sep 17 00:00:00 2001
From: Eden Chuang <echuang@mozilla.com>
Date: Tue, 5 Oct 2021 10:12:46 +0000
Subject: [PATCH] Bug 1731763 - Always null-check on
 ParymentRequest::mAcceptPromise and PaymentResponse::mRetryPromise. r=jstutte

Since PaymentRequest::mAcceptPromise and PaymentResponse::mRetryPromise can be nulled in PaymentRequest::NotifyOwnerDocumentActivityChanged(), always null-check on these promise when calling RespondShowPayment() and RespondRetry().

Differential Revision: https://phabricator.services.mozilla.com/D127110
---
 dom/payments/PaymentRequest.cpp  | 8 ++++++--
 dom/payments/PaymentResponse.cpp | 4 ++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/dom/payments/PaymentRequest.cpp b/dom/payments/PaymentRequest.cpp
index 0b632d4cc0ed..ebf0211e5e2b 100644
--- a/dom/payments/PaymentRequest.cpp
+++ b/dom/payments/PaymentRequest.cpp
@@ -790,7 +790,6 @@ void PaymentRequest::RespondShowPayment(const nsAString& aMethodName,
                                         const nsAString& aPayerEmail,
                                         const nsAString& aPayerPhone,
                                         ErrorResult&& aResult) {
-  MOZ_ASSERT(mAcceptPromise || mResponse);
   MOZ_ASSERT(mState == eInteractive);
 
   if (aResult.Failed()) {
@@ -805,12 +804,17 @@ void PaymentRequest::RespondShowPayment(const nsAString& aMethodName,
   if (mResponse) {
     mResponse->RespondRetry(aMethodName, mShippingOption, mShippingAddress,
                             aDetails, aPayerName, aPayerEmail, aPayerPhone);
-  } else {
+  } else if (mAcceptPromise) {
     RefPtr<PaymentResponse> paymentResponse = new PaymentResponse(
         GetOwner(), this, mId, aMethodName, mShippingOption, mShippingAddress,
         aDetails, aPayerName, aPayerEmail, aPayerPhone);
     mResponse = paymentResponse;
     mAcceptPromise->MaybeResolve(paymentResponse);
+  } else {
+    // mAccpetPromise could be nulled through document activity changed. And
+    // there is nothing to do here.
+    mState = eClosed;
+    return;
   }
 
   mState = eClosed;
diff --git a/dom/payments/PaymentResponse.cpp b/dom/payments/PaymentResponse.cpp
index a752e16f9078..690d34fa6f48 100644
--- a/dom/payments/PaymentResponse.cpp
+++ b/dom/payments/PaymentResponse.cpp
@@ -280,6 +280,10 @@ void PaymentResponse::RespondRetry(const nsAString& aMethodName,
                                    const nsAString& aPayerName,
                                    const nsAString& aPayerEmail,
                                    const nsAString& aPayerPhone) {
+  // mRetryPromise could be nulled when document activity is changed.
+  if (!mRetryPromise) {
+    return;
+  }
   mMethodName = aMethodName;
   mShippingOption = aShippingOption;
   mShippingAddress = aShippingAddress;