diff options
| author | Josh Matthews <josh@joshmatthews.net> | 2025-05-07 00:35:26 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-05-07 04:35:26 +0000 |
| commit | a18c6e2c78b5958948dc9775e2c81e631e487911 (patch) | |
| tree | 4dfd345e0b4fe43b96722dcd51eb97e0d452c87b /src/components/script/dom/bindings/codegen/HTMLSelectElement.webidl | |
| parent | ba8f9232017266d24f170f371d56a5bc8259bf59 (diff) | |
| download | servo-a18c6e2c78b5958948dc9775e2c81e631e487911.tar.gz servo-a18c6e2c78b5958948dc9775e2c81e631e487911.zip | |
Fix double borrow panic in Node.childNodes (#36889)
`ensure_rare_data` returns a RefMut that extends the borrow of
Node.rare_data. This can lead to a panic in any method that triggers a
GC while this borrow is outstanding, such as Node.childNodes.
Testing: Manual testing on the testcase from the issue. It is impossible
to create a deterministic WPT crash test that is fast enough and can be
counted upon to continue working in the future.
Fixes: #36868
Signed-off-by: Josh Matthews <josh@joshmatthews.net>
Diffstat (limited to 'src/components/script/dom/bindings/codegen/HTMLSelectElement.webidl')
0 files changed, 0 insertions, 0 deletions