diff options
| author | Martin Robinson <mrobinson@igalia.com> | 2023-08-18 06:00:44 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-08-18 04:00:44 +0000 |
| commit | 218ad8f574317846b591784c4c60af07aa72730d (patch) | |
| tree | 19930638442c70435fe64bbd3906bc0b91506035 | |
| parent | 0fb2dc70ff89dbba98cc066ec4a1058076f243c4 (diff) | |
| download | servo-218ad8f574317846b591784c4c60af07aa72730d.tar.gz servo-218ad8f574317846b591784c4c60af07aa72730d.zip | |
Fix /custom-elements/when-defined-reentry-crash.html (#30121)
The problem is a double-borrow of the `when_defined` member. The fix is
to let go of the borrow before resolving the promise which will
eventually try to borrow `when_defined` again.
Fixes #30120.
| -rw-r--r-- | components/script/dom/customelementregistry.rs | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/components/script/dom/customelementregistry.rs b/components/script/dom/customelementregistry.rs index df458ec90c3..ba36a2d30df 100644 --- a/components/script/dom/customelementregistry.rs +++ b/components/script/dom/customelementregistry.rs @@ -397,7 +397,8 @@ impl CustomElementRegistryMethods for CustomElementRegistry { } // Step 16, 16.3 - if let Some(promise) = self.when_defined.borrow_mut().remove(&name) { + let promise = self.when_defined.borrow_mut().remove(&name); + if let Some(promise) = promise { unsafe { rooted!(in(*cx) let mut constructor = UndefinedValue()); definition |