Skip to content

GitLab

T
tangled
Commit c415acc1 authored by Kouhei Ueno's avatar Kouhei Ueno Committed by Commit Bot
Browse files
Options

Prevent promise reject to be sync scheduled during DocumentLoader detach 

Bug: 868592
Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_slimming_paint_v2;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I5cff4653a62c357e8eb9d5a82a11b8018653b712
Reviewed-on: https://chromium-review.googlesource.com/1163235Reviewed-by: default avatarYuki Shiino <yukishiino@chromium.org>
Reviewed-by: default avatarYutaka Hirano <yhirano@chromium.org>
Commit-Queue: Kouhei Ueno <kouhei@chromium.org>
Cr-Commit-Position: refs/heads/master@{#580814}
parent 885bca11
Hide whitespace changes
Inline Side-by-side
Showing with 7 additions and 27 deletions
third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-gen-property-trees
View file @ c415acc1
......@@ -48,7 +48,6 @@ Bug(none) navigator_webdriver/ [ Skip ]
Bug(none) netinfo/ [ Skip ]
Bug(none) nfc/ [ Skip ]
Bug(none) payments/ [ Skip ]
Bug(none) performance/ [ Skip ]
Bug(none) permissionclient/ [ Skip ]
Bug(none) platform/ [ Skip ]
Bug(none) plugins/ [ Skip ]
......
third_party/WebKit/LayoutTests/performance/performance-observer-crash.html deleted 100644 → 0
View file @ 885bca11
<html>
<head>
<title>Crash page</title>
<script>
var observer = new PerformanceObserver(() => {});
function disconnectObserver() {
observer.disconnect();
testRunner.notifyDone();
}
function beginFetch() {
fetch('http://localhost/not-exists.jpg').catch(disconnectObserver);
}
function navigate() {
window.addEventListener("unload", beginFetch);
location.assign("about:blank");
};
testRunner.dumpAsText();
testRunner.setCustomTextOutput("");
testRunner.waitUntilDone();
</script>
</head>
<body onload="navigate()">
<p>This page will try to crash the renderer</p>
</body>
</html>
third_party/blink/renderer/core/fetch/fetch_manager.cc
View file @ c415acc1
......@@ -33,6 +33,7 @@
#include "third_party/blink/renderer/core/probe/core_probes.h"
#include "third_party/blink/renderer/core/typed_arrays/dom_array_buffer.h"
#include "third_party/blink/renderer/platform/bindings/exception_state.h"
#include "third_party/blink/renderer/platform/bindings/script_forbidden_scope.h"
#include "third_party/blink/renderer/platform/bindings/script_state.h"
#include "third_party/blink/renderer/platform/bindings/v8_throw_exception.h"
#include "third_party/blink/renderer/platform/exported/wrapped_resource_response.h"
......@@ -900,6 +901,12 @@ void FetchManager::Loader::Failed(const String& message) {
ConsoleMessage::Create(kJSMessageSource, kErrorMessageLevel, message));
}
if (resolver_) {
// This ScriptForbiddenScope forcibly punt the reject task to prevent the
// promise reject microtask to be queued synchronously during
// DocumentLoader detach.
// TODO(crbug.com/868592) Fix this properly.
ScriptForbiddenScope forbid;
ScriptState* state = resolver_->GetScriptState();
ScriptState::Scope scope(state);
resolver_->Reject(V8ThrowException::CreateTypeError(state->GetIsolate(),
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment