Changeset 290152 in webkit

Timestamp:

Feb 18, 2022, 12:27:21 PM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Keep promise in scope when calling DeferredPromise::reject
​https://bugs.webkit.org/show_bug.cgi?id=236454

Patch by Gabriel Nava Marino <​gnavamarino@apple.com> on 2022-02-18
Reviewed by Darin Adler.

Keep promise in scope when calling DeferredPromise::reject, as createDOMException
could go through a path that invokes GC on its owner and the promise.

• Modules/fetch/FetchBodyConsumer.cpp:

(WebCore::FetchBodyConsumer::resolveWithFormData):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• Modules/fetch/FetchBodyConsumer.cpp (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2022-02-18  Gabriel Nava Marino  <gnavamarino@apple.com>
+
+        Keep promise in scope when calling DeferredPromise::reject
+        https://bugs.webkit.org/show_bug.cgi?id=236454
+
+        Reviewed by Darin Adler.
+
+        Keep promise in scope when calling DeferredPromise::reject, as createDOMException
+        could go through a path that invokes GC on its owner and the promise.
+
+        * Modules/fetch/FetchBodyConsumer.cpp:
+        (WebCore::FetchBodyConsumer::resolveWithFormData):
+
 2022-02-18  Tim Horton  <timothy_horton@apple.com>
 

trunk/Source/WebCore/Modules/fetch/FetchBodyConsumer.cpp

@@ -270 +270 @@
         return;
 
-    m_formDataConsumer = makeUnique<FormDataConsumer>(formData, *context, [this, promise = WTFMove(promise), contentType, builder = SharedBufferBuilder { }](auto&& result) mutable {
+    m_formDataConsumer = makeUnique<FormDataConsumer>(formData, *context, [this, capturedPromise = WTFMove(promise), contentType, builder = SharedBufferBuilder { }](auto&& result) mutable {
         if (result.hasException()) {
+            auto promise = WTFMove(capturedPromise);
             promise->reject(result.releaseException());
             return;
@@ -279 +280 @@
         if (value.empty()) {
             auto buffer = builder.takeAsContiguous();
-            resolveWithData(WTFMove(promise), contentType, buffer->data(), buffer->size());
+            resolveWithData(WTFMove(capturedPromise), contentType, buffer->data(), buffer->size());
             return;
         }