From 7ea5951e3436a60980661cc63a25cec976e727e9 Mon Sep 17 00:00:00 2001 From: Taym Haddadi Date: Mon, 5 May 2025 14:10:33 +0200 Subject: [PATCH] Avoid borrow panic when Path2D.addPath is called with self (#36847) Fixes: #36842 Signed-off-by: Taym --- components/script/dom/path2d.rs | 10 ++++++++-- tests/wpt/mozilla/meta/MANIFEST.json | 7 +++++++ .../mozilla/tests/mozilla/path2D_addPath-crash.html | 5 +++++ 3 files changed, 20 insertions(+), 2 deletions(-) create mode 100644 tests/wpt/mozilla/tests/mozilla/path2D_addPath-crash.html diff --git a/components/script/dom/path2d.rs b/components/script/dom/path2d.rs index c5b6c34a79d..476889cfbbc 100644 --- a/components/script/dom/path2d.rs +++ b/components/script/dom/path2d.rs @@ -65,8 +65,14 @@ impl Path2DMethods for Path2D { /// fn AddPath(&self, other: &Path2D) { // Step 7. Add all the subpaths in c to a. - let mut dest = self.path.borrow_mut(); - dest.extend(other.path.borrow().iter().copied()); + if std::ptr::eq(&self.path, &other.path) { + // Note: this is not part of the spec, but it is a workaround to + // avoids borrow conflict when path is same as other.path + self.path.borrow_mut().extend_from_within(..); + } else { + let mut dest = self.path.borrow_mut(); + dest.extend(other.path.borrow().iter().copied()); + } } /// diff --git a/tests/wpt/mozilla/meta/MANIFEST.json b/tests/wpt/mozilla/meta/MANIFEST.json index a3f77769a9d..78b1ca5e8b3 100644 --- a/tests/wpt/mozilla/meta/MANIFEST.json +++ b/tests/wpt/mozilla/meta/MANIFEST.json @@ -53,6 +53,13 @@ {} ] ], + "path2D_addPath-crash.html": [ + "f913e6baf8340886c58f99609755ae061bf64f12", + [ + null, + {} + ] + ], "test-wait-crash.html": [ "2419da6af0c278a17b9ff974d4418f9e386ef3e0", [ diff --git a/tests/wpt/mozilla/tests/mozilla/path2D_addPath-crash.html b/tests/wpt/mozilla/tests/mozilla/path2D_addPath-crash.html new file mode 100644 index 00000000000..f913e6baf83 --- /dev/null +++ b/tests/wpt/mozilla/tests/mozilla/path2D_addPath-crash.html @@ -0,0 +1,5 @@ + +