From 2d28d1b9e757a35095de45c818a0432e031f339d Mon Sep 17 00:00:00 2001 From: Vincent Hilla Date: Tue, 23 Jul 2024 21:42:02 +0000 Subject: [PATCH] Bug 1908466 - Ensure source signal is not null when creating a dependent signal. a=dmeehan Original Revision: https://phabricator.services.mozilla.com/D217233 Differential Revision: https://phabricator.services.mozilla.com/D217452 --- dom/abort/AbortSignal.cpp | 6 +++++ .../dom/abort/abort-signal-any-crash.html | 23 +++++++++++++++++++ 2 files changed, 29 insertions(+) create mode 100644 testing/web-platform/tests/dom/abort/abort-signal-any-crash.html diff --git a/dom/abort/AbortSignal.cpp b/dom/abort/AbortSignal.cpp index de5f24c080ec..6694a4934db7 100644 --- a/dom/abort/AbortSignal.cpp +++ b/dom/abort/AbortSignal.cpp @@ -291,6 +291,12 @@ already_AddRefed AbortSignal::Any( } else { // Step 4.2. Otherwise, make resultSignal dependent on its source signals for (const auto& sourceSignal : signal->mSourceSignals) { + if (!sourceSignal) { + // Bug 1908466, sourceSignal might have been garbage collected. + // As signal is not aborted, sourceSignal also wasn't. + // Thus do not depend on it, as it cannot be aborted anymore. + continue; + } MOZ_ASSERT(!sourceSignal->Aborted() && !sourceSignal->Dependent()); resultSignal->MakeDependentOn(sourceSignal); } diff --git a/testing/web-platform/tests/dom/abort/abort-signal-any-crash.html b/testing/web-platform/tests/dom/abort/abort-signal-any-crash.html new file mode 100644 index 000000000000..912c0d0ada73 --- /dev/null +++ b/testing/web-platform/tests/dom/abort/abort-signal-any-crash.html @@ -0,0 +1,23 @@ + + + + AbortSignal::Any when source signal was garbage collected + + + + + +

Test passes if the browser does not crash.

+ + +