From db2d313a1b76886c656a90280bfe4f44b909d977 Mon Sep 17 00:00:00 2001
From: Kunal Mohan <kunalmohan99@gmail.com>
Date: Sat, 27 Jun 2020 21:20:50 +0530
Subject: [PATCH] Fix ArrayBuffer creation in buffer mapping

---
 components/script/dom/gpubuffer.rs | 10 ++++------
 components/script/dom/gpudevice.rs | 10 ++++++----
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/components/script/dom/gpubuffer.rs b/components/script/dom/gpubuffer.rs
index 07c1c525359..474c30dba0f 100644
--- a/components/script/dom/gpubuffer.rs
+++ b/components/script/dom/gpubuffer.rs
@@ -19,7 +19,6 @@ use dom_struct::dom_struct;
 use js::jsapi::{Heap, JSObject};
 use js::jsval::UndefinedValue;
 use js::rust::jsapi_wrapped::{DetachArrayBuffer, IsPromiseObject, RejectPromise};
-use js::rust::MutableHandle;
 use js::typedarray::{ArrayBuffer, CreateWith};
 use std::cell::Cell;
 use std::ops::Range;
@@ -277,12 +276,10 @@ impl AsyncWGPUListener for GPUBuffer {
     fn handle_response(&self, response: WebGPUResponse, promise: &Rc<Promise>) {
         match response {
             WebGPUResponse::BufferMapAsync(bytes) => {
+                let cx = self.global().get_cx();
+                rooted!(in(*cx) let mut array_buffer = ptr::null_mut::<JSObject>());
                 match unsafe {
-                    ArrayBuffer::create(
-                        *self.global().get_cx(),
-                        CreateWith::Slice(&bytes),
-                        MutableHandle::from_raw(self.mapping.handle_mut()),
-                    )
+                    ArrayBuffer::create(*cx, CreateWith::Slice(&bytes), array_buffer.handle_mut())
                 } {
                     Ok(_) => promise.resolve_native(&()),
                     Err(()) => {
@@ -293,6 +290,7 @@ impl AsyncWGPUListener for GPUBuffer {
                         promise.reject_error(Error::Operation);
                     },
                 }
+                self.mapping.set(array_buffer.get());
                 self.state.set(GPUBufferState::Mapped);
             },
             _ => {
diff --git a/components/script/dom/gpudevice.rs b/components/script/dom/gpudevice.rs
index 08bc4f05744..0eb5771baac 100644
--- a/components/script/dom/gpudevice.rs
+++ b/components/script/dom/gpudevice.rs
@@ -54,9 +54,8 @@ use crate::script_runtime::JSContext as SafeJSContext;
 use arrayvec::ArrayVec;
 use dom_struct::dom_struct;
 use js::jsapi::{Heap, JSObject};
-use js::rust::MutableHandle;
 use js::typedarray::{ArrayBuffer, CreateWith};
-use std::ptr::NonNull;
+use std::ptr::{self, NonNull};
 use webgpu::wgpu::binding_model::BufferBinding;
 use webgpu::{self, wgt, WebGPU, WebGPUBindings, WebGPURequest};
 
@@ -182,14 +181,17 @@ impl GPUDeviceMethods for GPUDevice {
         let state;
         let mapping_range;
         if descriptor.mappedAtCreation {
+            let cx = self.global().get_cx();
+            rooted!(in(*cx) let mut array_buffer = ptr::null_mut::<JSObject>());
             unsafe {
                 assert!(ArrayBuffer::create(
-                    *self.global().get_cx(),
+                    *cx,
                     CreateWith::Length(descriptor.size as u32),
-                    MutableHandle::from_raw(mapping.handle_mut()),
+                    array_buffer.handle_mut(),
                 )
                 .is_ok());
             }
+            mapping.set(array_buffer.get());
             state = GPUBufferState::MappedAtCreation;
             mapping_range = 0..descriptor.size;
         } else {