Bug 1686154 - Fix the race condition on WorkerFetchResolver::mFetchOb…

…server. r=asuth

Differential Revision: https://phabricator.services.mozilla.com/D111525

dom/fetch/Fetch.cpp

@@ -266,6 +266,8 @@ class WorkerFetchResolver final : public FetchDriverObserver {
   RefPtr<WeakWorkerRef> mWorkerRef;
   bool mIsShutdown;
 
+  Atomic<bool> mNeedOnDataAvailable;
+
  public:
   // Returns null if worker is shutting down.
   static already_AddRefed<WorkerFetchResolver> Create(
@@ -354,6 +356,7 @@ class WorkerFetchResolver final : public FetchDriverObserver {
     mIsShutdown = true;
     mPromiseProxy->CleanUp();
 
+    mNeedOnDataAvailable = false;
     mFetchObserver = nullptr;
 
     if (mSignalProxy) {
@@ -376,7 +379,8 @@ class WorkerFetchResolver final : public FetchDriverObserver {
       : mPromiseProxy(aProxy),
         mSignalProxy(aSignalProxy),
         mFetchObserver(aObserver),
-        mIsShutdown(false) {
+        mIsShutdown(false),
+        mNeedOnDataAvailable(!!aObserver) {
     MOZ_ASSERT(!NS_IsMainThread());
     MOZ_ASSERT(mPromiseProxy);
   }
@@ -871,8 +875,7 @@ void WorkerFetchResolver::OnResponseAvailableInternal(
 
 bool WorkerFetchResolver::NeedOnDataAvailable() {
   AssertIsOnMainThread();
-  MutexAutoLock lock(mPromiseProxy->Lock());
-  return !!mFetchObserver;
+  return mNeedOnDataAvailable;
 }
 
 void WorkerFetchResolver::OnDataAvailable() {

dom/promise/Promise.cpp

@@ -806,8 +806,6 @@ void PromiseWorkerProxy::CleanUp() {
     // Release the Promise and remove the PromiseWorkerProxy from the holders of
     // the worker thread since the Promise has been resolved/rejected or the
     // worker thread has been cancelled.
-    mWorkerRef = nullptr;
-
     CleanProperties();
   }
   Release();