Mirrors/servo
1
0
Fork 0
mirror of https://github.com/servo/servo.git synced 2025-08-03 04:30:10 +01:00
Code Issues Projects Releases Packages Wiki Activity

Fix crash when enumerating properties of global object (#36491)

Browse source 
These changes make our implementation of the enumeration hook for
globals [match
Gecko's](https://searchfox.org/mozilla-central/rev/1f65969e57c757146e3e548614b49d3a4168eeb8/dom/base/nsGlobalWindowInner.cpp#3297),
fixing an assertion failure that occurred in the previous
implementation.

Our enumeration hook is supposed to fill a vector with names of
properties on the global object without modifying the global in any way;
instead we were defining all of the missing webidl interfaces. We now do
much less work and crash less.

Testing: New crashtest based on manual testcase.
Fixes: #34686

---------

Signed-off-by: Josh Matthews <josh@joshmatthews.net>
This commit is contained in:
Josh Matthews 2025-04-16 23:32:53 -04:00 • committed by GitHub
parent a1b9949f75
commit 30390f8c5e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
9 changed files with 98 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

13
components/script_bindings/interfaces.rs
View file

@ -23,6 +23,17 @@ use crate::script_runtime::{CanGc, JSContext};
use crate::settings_stack::StackEntry;
use crate::utils::ProtoOrIfaceArray;
/// Operations that can be invoked for a WebIDL interface against
/// a global object.
///
/// <https://github.com/mozilla/gecko-dev/blob/3fd619f47/dom/bindings/WebIDLGlobalNameHash.h#L24>
pub struct Interface {
/// Define the JS object for this interface on the given global.
pub define: fn(JSContext, HandleObject),
/// Returns true if this interface's conditions are met for the given global.
pub enabled: fn(JSContext, HandleObject) -> bool,
}
/// Operations that must be invoked from the generated bindings.
pub trait DomHelpers<D: DomTypes> {
fn throw_dom_exception(cx: JSContext, global: &D::GlobalScope, result: Error, can_gc: CanGc);
@ -42,7 +53,7 @@ pub trait DomHelpers<D: DomTypes> {
fn is_platform_object_same_origin(cx: JSContext, obj: RawHandleObject) -> bool;
fn interface_map() -> &'static phf::Map<&'static [u8], for<'a> fn(JSContext, HandleObject)>;
fn interface_map() -> &'static phf::Map<&'static [u8], Interface>;
fn push_new_element_queue();
fn pop_current_element_queue(can_gc: CanGc);