nagai/fune
3
0
Fork 0
forked from mirrors/gecko-dev
Code Pull requests Activity

Bug 1908466 - Ensure source signal is not null when creating a dependent signal. a=dmeehan

Browse source 
Original Revision: https://phabricator.services.mozilla.com/D217233

Differential Revision: https://phabricator.services.mozilla.com/D217452
This commit is contained in:
Vincent Hilla 2024-07-23 21:42:02 +00:00
parent 022eb9e926
commit 2d28d1b9e7
2 changed files with 29 additions and 0 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

6
dom/abort/AbortSignal.cpp
View file

@ -291,6 +291,12 @@ already_AddRefed<AbortSignal> AbortSignal::Any(
} else {
// Step 4.2. Otherwise, make resultSignal dependent on its source signals
for (const auto& sourceSignal : signal->mSourceSignals) {
if (!sourceSignal) {
// Bug 1908466, sourceSignal might have been garbage collected.
// As signal is not aborted, sourceSignal also wasn't.
// Thus do not depend on it, as it cannot be aborted anymore.
continue;
}
MOZ_ASSERT(!sourceSignal->Aborted() && !sourceSignal->Dependent());
resultSignal->MakeDependentOn(sourceSignal);
}

23
testing/web-platform/tests/dom/abort/abort-signal-any-crash.html Normal file
View file

@ -0,0 +1,23 @@
<!DOCTYPE html>
<html class=test-wait>
<head>
<title>AbortSignal::Any when source signal was garbage collected</title>
<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1908466">
<link rel="author" title="Vincent Hilla" href="mailto:vhilla@mozilla.com">
<script src="/common/gc.js"></script>
</head>
<body>
<p>Test passes if the browser does not crash.</p>
<script>
async function test() {
let controller = new AbortController();
let signal = AbortSignal.any([controller.signal]);
controller = undefined;
await garbageCollect();
AbortSignal.any([signal]);
document.documentElement.classList.remove('test-wait');
}
test();
</script>
</body>
</html>