From 20d67bdc441eeb61c52c38dd034eaec6504b3b32 Mon Sep 17 00:00:00 2001
From: Josh Matthews <josh@joshmatthews.net>
Date: Thu, 26 Dec 2024 00:01:11 -0500
Subject: [PATCH] Ensure ConsumeBodyPromiseHandler values are always rooted
 (#34194)

* script: Root the use of ComsumeBodyPromiseHandler.

Signed-off-by: Josh Matthews <josh@joshmatthews.net>

* Update mozjs and run crown on mozjs_sys.

Signed-off-by: Josh Matthews <josh@joshmatthews.net>

---------

Signed-off-by: Josh Matthews <josh@joshmatthews.net>
---
 .cargo/config.toml        |  2 +-
 Cargo.lock                |  6 +++---
 components/script/body.rs | 10 ++++++----
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/.cargo/config.toml b/.cargo/config.toml
index 19269c29e82..7ebead7263d 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -30,7 +30,7 @@ linker = "lld-link.exe"
 
 [env]
 MACOSX_DEPLOYMENT_TARGET = "13.0"
-RUSTC_BOOTSTRAP = "crown,script,style_tests,mozjs"
+RUSTC_BOOTSTRAP = "crown,script,style_tests,mozjs,mozjs_sys"
 
 [build]
 rustdocflags = ["--document-private-items"]
diff --git a/Cargo.lock b/Cargo.lock
index a3d4d0947a0..37ff3c54bbd 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4447,7 +4447,7 @@ dependencies = [
 [[package]]
 name = "mozjs"
 version = "0.14.1"
-source = "git+https://github.com/servo/mozjs#ce24cb7ef19f0d649ecaa90b6e006c7c213ef991"
+source = "git+https://github.com/servo/mozjs#1765a7c7eaf1e4a02fdfff6866c8f427c659dc91"
 dependencies = [
  "bindgen",
  "cc",
@@ -4459,8 +4459,8 @@ dependencies = [
 
 [[package]]
 name = "mozjs_sys"
-version = "0.128.6-0"
-source = "git+https://github.com/servo/mozjs#ce24cb7ef19f0d649ecaa90b6e006c7c213ef991"
+version = "0.128.6-1"
+source = "git+https://github.com/servo/mozjs#1765a7c7eaf1e4a02fdfff6866c8f427c659dc91"
 dependencies = [
  "bindgen",
  "cc",
diff --git a/components/script/body.rs b/components/script/body.rs
index 17693550554..d84e39cd2f9 100644
--- a/components/script/body.rs
+++ b/components/script/body.rs
@@ -611,6 +611,8 @@ impl Callback for ConsumeBodyPromiseRejectionHandler {
     }
 }
 
+impl js::gc::Rootable for ConsumeBodyPromiseHandler {}
+
 #[derive(Clone, JSTraceable, MallocSizeOf)]
 #[crown::unrooted_must_root_lint::must_root]
 /// The promise handler used to consume the body,
@@ -747,7 +749,6 @@ pub fn consume_body<T: BodyMixin + DomObject>(
 }
 
 // https://fetch.spec.whatwg.org/#concept-body-consume-body
-#[allow(crown::unrooted_must_root)]
 fn consume_body_with_promise<T: BodyMixin + DomObject>(
     object: &T,
     body_type: BodyType,
@@ -777,14 +778,15 @@ fn consume_body_with_promise<T: BodyMixin + DomObject>(
     // https://fetch.spec.whatwg.org/#concept-read-all-bytes-from-readablestream
     let read_promise = stream.read_a_chunk(can_gc);
 
-    let promise_handler = Box::new(ConsumeBodyPromiseHandler {
+    let cx = GlobalScope::get_cx();
+    rooted!(in(*cx) let mut promise_handler = Some(ConsumeBodyPromiseHandler {
         result_promise: promise.clone(),
         stream: Some(Dom::from_ref(&stream)),
         body_type: DomRefCell::new(Some(body_type)),
         mime_type: DomRefCell::new(Some(object.get_mime_type(can_gc))),
         // Step 2.
         bytes: DomRefCell::new(Some(vec![])),
-    });
+    }));
 
     let rejection_handler = Box::new(ConsumeBodyPromiseRejectionHandler {
         result_promise: promise,
@@ -792,7 +794,7 @@ fn consume_body_with_promise<T: BodyMixin + DomObject>(
 
     let handler = PromiseNativeHandler::new(
         &object.global(),
-        Some(promise_handler),
+        promise_handler.take().map(|h| Box::new(h) as Box<_>),
         Some(rejection_handler),
     );
     // We are already in a realm and a script.