Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6184395225722949a9a83b80a7b78d9aaf3fa829
https://github.com/WebKit/WebKit/commit/6184395225722949a9a83b80a7b78d9aaf3fa829
Author: Youenn Fablet <[email protected]>
Date: 2026-07-10 (Fri, 10 Jul 2026)
Changed paths:
A
LayoutTests/streams/readable-stream-from-cancel-pending-next-crash-expected.txt
A LayoutTests/streams/readable-stream-from-cancel-pending-next-crash.html
M Source/WebCore/Modules/streams/ReadableStream.cpp
M Source/WebCore/bindings/js/DOMAsyncIterator.cpp
M Source/WebCore/bindings/js/DOMAsyncIterator.h
M Source/WebCore/bindings/js/JSDOMPromise.cpp
M Source/WebCore/bindings/js/JSDOMPromise.h
Log Message:
-----------
DOMAsyncIterator should not store the callNext and callReturn callback as the
same member
rdar://181790407
https://bugs.webkit.org/show_bug.cgi?id=318941
Reviewed by Sihui Liu.
DOMAsyncIterator stored the pending completion callback in a single m_callback
member and re-used the slot for both callNext and callReturn.
When callReturn was invoked (e.g. because the ReadableStream wrapping the
iterator was cancelled) while a callNext promise was still pending,
the second call overwrites m_callback which could lead to the wrong callback
being called.
We move the callback ownership into the lambda captured by
DOMPromise::whenPromiseIsSettled, so each callNext/callReturn owns its own
callback for the lifetime of its promise.
The m_callback member and the handleCallbackWithPromise helper are no longer
needed.
We preserve the old behavior of invoking the caller-supplied callback with
isOK=false when JSBoundFunction::create fails to register,
by introducing an opt-in ShouldCallCallbackOnRegistrationFailure parameter to
DOMPromise::whenPromiseIsSettled.
This is off by default and used in DOMAsyncIterator call sites.
We guard the ReadableStream::from pull continuation with an m_isCancelled flag
set in doCancel.
That way, a callNext result that arrives after cancel does not touch the
controller.
Test: streams/readable-stream-from-cancel-pending-next-crash.html
*
LayoutTests/streams/readable-stream-from-cancel-pending-next-crash-expected.txt:
Added.
* LayoutTests/streams/readable-stream-from-cancel-pending-next-crash.html:
Added.
* Source/WebCore/Modules/streams/ReadableStream.cpp:
* Source/WebCore/bindings/js/DOMAsyncIterator.cpp:
(WebCore::DOMAsyncIterator::callNext):
(WebCore::DOMAsyncIterator::callReturn):
(WebCore::DOMAsyncIterator::handleCallbackWithPromise): Deleted.
* Source/WebCore/bindings/js/DOMAsyncIterator.h:
* Source/WebCore/bindings/js/JSDOMPromise.cpp:
(WebCore::DOMPromise::whenPromiseIsSettled):
* Source/WebCore/bindings/js/JSDOMPromise.h:
Canonical link: https://commits.webkit.org/316874@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
