Mirrors/servo
1
0
Fork 0
mirror of https://github.com/servo/servo.git synced 2025-08-04 05:00:08 +01:00
Code Issues Projects Releases Packages Wiki Activity

script: Avoid double borrow crash in DataTransferItem (#35699)

Browse source 
* avoid double borrow inside GetAsString

Signed-off-by: Gae24 <96017547+Gae24@users.noreply.github.com>

* added crashtest

Signed-off-by: Gae24 <96017547+Gae24@users.noreply.github.com>

---------

Signed-off-by: Gae24 <96017547+Gae24@users.noreply.github.com>
This commit is contained in:
Gae24 2025-02-27 20:28:35 +01:00 • committed by GitHub
parent 8a3f62933b
commit 900655fbc7
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 24 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
components/script/dom/datatransferitem.rs
View file

@ -123,7 +123,8 @@ impl DataTransferItemMethods<crate::DomTypeHolder> for DataTransferItem {
.task_manager() .task_manager()
.dom_manipulation_task_source() .dom_manipulation_task_source()
.queue(task!(invoke_callback: move || { .queue(task!(invoke_callback: move || {
if let Some(index) = this.root().pending_callbacks.borrow().iter().position(|val| val.id == id) { let maybe_index = this.root().pending_callbacks.borrow().iter().position(|val| val.id == id);
if let Some(index) = maybe_index {
let callback = this.root().pending_callbacks.borrow_mut().swap_remove(index).callback; let callback = this.root().pending_callbacks.borrow_mut().swap_remove(index).callback;
let _ = callback.Call__(DOMString::from(string), ExceptionHandling::Report); let _ = callback.Call__(DOMString::from(string), ExceptionHandling::Report);
} }

7
tests/wpt/mozilla/meta/MANIFEST.json vendored
View file

@ -9,6 +9,13 @@
{} {}
] ]
], ],
"datatransferitem-crash.html": [
"d11355ab38c1e99e0ba3e10d7dfed18bf26af60b",
[
null,
{}
]
],
"test-wait-crash.html": [ "test-wait-crash.html": [
"2419da6af0c278a17b9ff974d4418f9e386ef3e0", "2419da6af0c278a17b9ff974d4418f9e386ef3e0",
[ [

15
tests/wpt/mozilla/tests/mozilla/datatransferitem-crash.html vendored Normal file
View file

@ -0,0 +1,15 @@
<!DOCTYPE html>
<html>
<meta charset="utf-8">
<meta name="assert" content="GetAsString shouldn't crash.">
<script>
const dt = new DataTransfer();
dt.items.add("data", "text/plain");
let item = dt.items[0];
item.getAsString(str => {
console.log(`Calling getAsString on a item shouldn't crash`);
});
</script>