From 900655fbc7dd20a6aae4f909fcce44a6f967fb1e Mon Sep 17 00:00:00 2001 From: Gae24 <96017547+Gae24@users.noreply.github.com> Date: Thu, 27 Feb 2025 20:28:35 +0100 Subject: [PATCH] script: Avoid double borrow crash in `DataTransferItem` (#35699) * avoid double borrow inside GetAsString Signed-off-by: Gae24 <96017547+Gae24@users.noreply.github.com> * added crashtest Signed-off-by: Gae24 <96017547+Gae24@users.noreply.github.com> --------- Signed-off-by: Gae24 <96017547+Gae24@users.noreply.github.com> --- components/script/dom/datatransferitem.rs | 3 ++- tests/wpt/mozilla/meta/MANIFEST.json | 7 +++++++ .../tests/mozilla/datatransferitem-crash.html | 15 +++++++++++++++ 3 files changed, 24 insertions(+), 1 deletion(-) create mode 100644 tests/wpt/mozilla/tests/mozilla/datatransferitem-crash.html diff --git a/components/script/dom/datatransferitem.rs b/components/script/dom/datatransferitem.rs index d4888d2f91c..db25b62178e 100644 --- a/components/script/dom/datatransferitem.rs +++ b/components/script/dom/datatransferitem.rs @@ -123,7 +123,8 @@ impl DataTransferItemMethods for DataTransferItem { .task_manager() .dom_manipulation_task_source() .queue(task!(invoke_callback: move || { - if let Some(index) = this.root().pending_callbacks.borrow().iter().position(|val| val.id == id) { + let maybe_index = this.root().pending_callbacks.borrow().iter().position(|val| val.id == id); + if let Some(index) = maybe_index { let callback = this.root().pending_callbacks.borrow_mut().swap_remove(index).callback; let _ = callback.Call__(DOMString::from(string), ExceptionHandling::Report); } diff --git a/tests/wpt/mozilla/meta/MANIFEST.json b/tests/wpt/mozilla/meta/MANIFEST.json index e23bcd9ea24..3e5e5a9f27c 100644 --- a/tests/wpt/mozilla/meta/MANIFEST.json +++ b/tests/wpt/mozilla/meta/MANIFEST.json @@ -9,6 +9,13 @@ {} ] ], + "datatransferitem-crash.html": [ + "d11355ab38c1e99e0ba3e10d7dfed18bf26af60b", + [ + null, + {} + ] + ], "test-wait-crash.html": [ "2419da6af0c278a17b9ff974d4418f9e386ef3e0", [ diff --git a/tests/wpt/mozilla/tests/mozilla/datatransferitem-crash.html b/tests/wpt/mozilla/tests/mozilla/datatransferitem-crash.html new file mode 100644 index 00000000000..d11355ab38c --- /dev/null +++ b/tests/wpt/mozilla/tests/mozilla/datatransferitem-crash.html @@ -0,0 +1,15 @@ + + + + + +