Mirrors/servo
1
0
Fork 0
mirror of https://github.com/servo/servo.git synced 2025-09-29 16:19:14 +01:00
Code Issues Projects Releases Packages Wiki Activity

script: when handling page headers, stop if pipeline closed already (#38739)

Browse source 
Previously, the script-thread would assert the pipeline was closed if no
pending load was found, but it did not check whether the pipeline was
closed before processing the page headers. Since incomplete loads are
removed only when page headers are processed, this means the page
headers were processed even if the pipeline had been closed before the
page headers were available. If the pipeline had been closed as part of
exiting the constellation, it was possible for the constellation to have
exited by the time the page headers became available(since the
script-thread closes a pipeline independently from ongoing navigation
fetches), which would produce a panic on trying to communicate with the
constellation to obtain the browsing context info.

Note: due to the nature of the problem, I cannot verify that this fixes
the crash test, although logically this appears to make sense, and a
couple of days of WPT runs should tell us more.

Testing: A crash test was added; unfortunately the crash was
intermittent.
Fixes: https://github.com/servo/servo/issues/36747

---------

Signed-off-by: gterzian <2792687+gterzian@users.noreply.github.com>
This commit is contained in:
Gregory Terzian 2025-08-26 03:04:39 +08:00 • committed by GitHub
parent ebf8a35c84
commit ddf5f1eb2f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 102 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

48
tests/wpt/meta/trusted-types/trusted-types-navigation.html.ini vendored
View file

@ -73,7 +73,21 @@
[trusted-types-navigation.html?26-30]
expected: CRASH
[Navigate a window via form-submission with javascript:-urls w/ default policy in enforcing mode.]
expected: FAIL
[Navigate a window via form-submission with javascript:-urls in report-only mode.]
expected: FAIL
[Navigate a window via form-submission with javascript:-urls w/ default policy in report-only mode.]
expected: FAIL
[Navigate a frame via form-submission with javascript:-urls in enforcing mode.]
expected: FAIL
[Navigate a frame via form-submission with javascript:-urls w/ default policy in enforcing mode.]
expected: FAIL
[trusted-types-navigation.html?06-10]
expected: CRASH
@ -94,7 +108,22 @@
[trusted-types-navigation.html?11-15]
expected: CRASH
expected: TIMEOUT
[Navigate a window via anchor with javascript:-urls w/ a default policy making the URL invalid in enforcing mode.]
expected: FAIL
[Navigate a window via anchor with javascript:-urls w/ a default policy making the URL invalid in report-only mode.]
expected: FAIL
[Navigate a window via area with javascript:-urls in enforcing mode.]
expected: FAIL
[Navigate a window via area with javascript:-urls w/ default policy in enforcing mode.]
expected: TIMEOUT
[Navigate a window via area with javascript:-urls in report-only mode.]
expected: NOTRUN
[trusted-types-navigation.html?16-20]
expected: TIMEOUT
@ -132,4 +161,17 @@
[trusted-types-navigation.html?01-05]
expected: CRASH
[Navigate a window via anchor with javascript:-urls in enforcing mode.]
expected: FAIL
[Navigate a window via anchor with javascript:-urls w/ default policy in enforcing mode.]
expected: FAIL
[Navigate a window via anchor with javascript:-urls in report-only mode.]
expected: FAIL
[Navigate a window via anchor with javascript:-urls w/ default policy in report-only mode.]
expected: FAIL
[Navigate a frame via anchor with javascript:-urls in enforcing mode.]
expected: FAIL

7
tests/wpt/mozilla/meta/MANIFEST.json vendored
View file

@ -32,6 +32,13 @@
{}
]
],
"form-navigate-loop-crash.html": [
"1068ccc38eed223cf83a4cbd8fed336b83c0b745",
[
null,
{}
]
],
"form_reset-crash.html": [
"b23cbf6aefdef8231e2cc4cb0e6416195d5bdf71",
[

10
tests/wpt/mozilla/tests/mozilla/form-navigate-loop-crash.html vendored Normal file
View file

@ -0,0 +1,10 @@
<!DOCTYPE html>
<script>
window.addEventListener("load", _ => {
form.submit();
window.frames.stop();
iframe.src = "data:text/html,";
});
</script>
<form id="form">
<iframe id="iframe"></iframe>