#600: M1588248 M1614704

dom/workers/XMLHttpRequest.cpp

@@ -1861,6 +1861,8 @@ XMLHttpRequest::SendInternal(SendRunnable* aRunnable,
   aRunnable->SetSyncLoopTarget(syncLoopTarget);
   aRunnable->SetHaveUploadListeners(hasUploadListeners);
 
+  mStateData.mFlagSend = true;
+
   if (!aRunnable->Dispatch(cx)) {
     // Dispatch() may have spun the event loop and we may have already unrooted.
     // If so we don't want autoUnpin to try again.
@@ -1879,7 +1881,11 @@ XMLHttpRequest::SendInternal(SendRunnable* aRunnable,
 
   autoUnpin.Clear();
 
-  if (!autoSyncLoop->Run()) {
+  bool succeeded = autoSyncLoop->Run();
+  mStateData.mFlagSend = false;
+
+  if (!succeeded) {
+    // Somehow we didn't throw. Throw now.
     aRv.Throw(NS_ERROR_FAILURE);
   }
 }
@@ -2083,7 +2089,7 @@ XMLHttpRequest::Send(ErrorResult& aRv)
     return;
   }
 
-  if (!mProxy) {
+  if (!mProxy || mStateData.mFlagSend) {
     aRv.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
     return;
   }

dom/workers/XMLHttpRequest.h

@@ -44,11 +44,12 @@ public:
     nsresult mResponseTextResult;
     nsresult mStatusResult;
     nsresult mResponseResult;
+    bool mFlagSend; // TenFourFox issue 600 (backbugs for M1588248)
 
     StateData()
     : mStatus(0), mReadyState(0), mResponse(JS::UndefinedValue()),
       mResponseTextResult(NS_OK), mStatusResult(NS_OK),
-      mResponseResult(NS_OK)
+      mResponseResult(NS_OK), mFlagSend(false)
     { }
   };
 

js/src/jit/MIR.h

@@ -4737,9 +4737,10 @@ class MCreateThis
         return getOperand(0);
     }
 
-    // Although creation of |this| modifies global state, it is safely repeatable.
+    // Performs a property read from |newTarget| iff |newTarget| is a JSFunction
+    // with an own |.prototype| property.
     AliasSet getAliasSet() const override {
-        return AliasSet::None();
+        return AliasSet::Load(AliasSet::Any);
     }
     bool possiblyCalls() const override {
         return true;