nagai/fune
3
0
Fork 0
forked from mirrors/gecko-dev
Code Pull requests Activity

Bug 1819146, don't try to use destroyed global when accessing signal's reason, r=peterv

Browse source 
Differential Revision: https://phabricator.services.mozilla.com/D172131
This commit is contained in:
Olli Pettay 2023-03-10 15:14:32 +00:00
parent a11e1155cc
commit 2d7c41e636
3 changed files with 31 additions and 3 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

10
dom/locks/LockManager.cpp
View file

@ -97,9 +97,13 @@ static bool ValidateRequestArguments(const nsAString& name,
return false;
}
if (options.mSignal.Value().Aborted()) {
AutoEntryScript aes(options.mSignal.Value().GetParentObject(),
"LockManager::Request");
JSContext* cx = aes.cx();
AutoJSAPI jsapi;
if (!jsapi.Init(options.mSignal.Value().GetParentObject())) {
aRv.ThrowNotSupportedError("Signal's realm isn't active anymore.");
return false;
}
JSContext* cx = jsapi.cx();
JS::Rooted<JS::Value> reason(cx);
options.mSignal.Value().GetReason(cx, &reason);
aRv.MightThrowJSException();

23
dom/workers/test/crashtests/1819146.html Normal file
View file

@ -0,0 +1,23 @@
<!DOCTYPE html>
<html>
<head>
<script id="worker1" type="javascript/worker">
self.onmessage = async function (e) {
const abort = new AbortController()
const signal = abort.signal
abort.abort()
close()
try { await fetch(undefined, { signal: signal }) } catch (e) {}
await navigator.locks.request("weblock_0", { signal: signal }, () => {})
await fetch(undefined, { headers: [] })
}
</script>
<script>
document.addEventListener('DOMContentLoaded', () => {
const blob = new Blob([document.querySelector('#worker1').textContent], { type: 'text/javascript' })
const worker = new Worker(window.URL.createObjectURL(blob))
worker.postMessage([], [])
})
</script>
</head>
</html>

1
dom/workers/test/crashtests/crashtests.list
View file

@ -4,3 +4,4 @@ load 1153636.html
load 1158031.html
load 1228456.html
load 1348882.html
load 1819146.html