mirror of
https://github.com/servo/servo.git
synced 2025-08-04 05:00:08 +01:00
script: Avoid double borrow crash in DataTransferItem
(#35699)
* avoid double borrow inside GetAsString Signed-off-by: Gae24 <96017547+Gae24@users.noreply.github.com> * added crashtest Signed-off-by: Gae24 <96017547+Gae24@users.noreply.github.com> --------- Signed-off-by: Gae24 <96017547+Gae24@users.noreply.github.com>
This commit is contained in:
parent
8a3f62933b
commit
900655fbc7
3 changed files with 24 additions and 1 deletions
|
@ -123,7 +123,8 @@ impl DataTransferItemMethods<crate::DomTypeHolder> for DataTransferItem {
|
||||||
.task_manager()
|
.task_manager()
|
||||||
.dom_manipulation_task_source()
|
.dom_manipulation_task_source()
|
||||||
.queue(task!(invoke_callback: move || {
|
.queue(task!(invoke_callback: move || {
|
||||||
if let Some(index) = this.root().pending_callbacks.borrow().iter().position(|val| val.id == id) {
|
let maybe_index = this.root().pending_callbacks.borrow().iter().position(|val| val.id == id);
|
||||||
|
if let Some(index) = maybe_index {
|
||||||
let callback = this.root().pending_callbacks.borrow_mut().swap_remove(index).callback;
|
let callback = this.root().pending_callbacks.borrow_mut().swap_remove(index).callback;
|
||||||
let _ = callback.Call__(DOMString::from(string), ExceptionHandling::Report);
|
let _ = callback.Call__(DOMString::from(string), ExceptionHandling::Report);
|
||||||
}
|
}
|
||||||
|
|
7
tests/wpt/mozilla/meta/MANIFEST.json
vendored
7
tests/wpt/mozilla/meta/MANIFEST.json
vendored
|
@ -9,6 +9,13 @@
|
||||||
{}
|
{}
|
||||||
]
|
]
|
||||||
],
|
],
|
||||||
|
"datatransferitem-crash.html": [
|
||||||
|
"d11355ab38c1e99e0ba3e10d7dfed18bf26af60b",
|
||||||
|
[
|
||||||
|
null,
|
||||||
|
{}
|
||||||
|
]
|
||||||
|
],
|
||||||
"test-wait-crash.html": [
|
"test-wait-crash.html": [
|
||||||
"2419da6af0c278a17b9ff974d4418f9e386ef3e0",
|
"2419da6af0c278a17b9ff974d4418f9e386ef3e0",
|
||||||
[
|
[
|
||||||
|
|
15
tests/wpt/mozilla/tests/mozilla/datatransferitem-crash.html
vendored
Normal file
15
tests/wpt/mozilla/tests/mozilla/datatransferitem-crash.html
vendored
Normal file
|
@ -0,0 +1,15 @@
|
||||||
|
<!DOCTYPE html>
|
||||||
|
<html>
|
||||||
|
<meta charset="utf-8">
|
||||||
|
<meta name="assert" content="GetAsString shouldn't crash.">
|
||||||
|
|
||||||
|
<script>
|
||||||
|
const dt = new DataTransfer();
|
||||||
|
|
||||||
|
dt.items.add("data", "text/plain");
|
||||||
|
let item = dt.items[0];
|
||||||
|
|
||||||
|
item.getAsString(str => {
|
||||||
|
console.log(`Calling getAsString on a item shouldn't crash`);
|
||||||
|
});
|
||||||
|
</script>
|
Loading…
Add table
Add a link
Reference in a new issue