From c0bacc6c4bdeb3885e4b6ab9290a79f0f170c989 Mon Sep 17 00:00:00 2001 From: Andreas Kling Date: Sun, 3 Dec 2023 15:15:35 +0100 Subject: [PATCH] LibWeb: Fix two bad capture-by-reference bugs caught by ASAN In both cases, related to fetching/loading modules. --- Userland/Libraries/LibWeb/Bindings/MainThreadVM.cpp | 2 +- Userland/Libraries/LibWeb/HTML/Scripting/Fetching.cpp | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Userland/Libraries/LibWeb/Bindings/MainThreadVM.cpp b/Userland/Libraries/LibWeb/Bindings/MainThreadVM.cpp index 465238f614..3ae9a8a3c7 100644 --- a/Userland/Libraries/LibWeb/Bindings/MainThreadVM.cpp +++ b/Userland/Libraries/LibWeb/Bindings/MainThreadVM.cpp @@ -475,7 +475,7 @@ ErrorOr initialize_main_thread_vm() fetch_client = fetch_context.fetch_client; } - auto on_single_fetch_complete = HTML::create_on_fetch_script_complete(realm.heap(), [referrer, &realm, load_state, &module_request, payload](JS::GCPtr const& module_script) -> void { + auto on_single_fetch_complete = HTML::create_on_fetch_script_complete(realm.heap(), [referrer, &realm, load_state, module_request, payload](JS::GCPtr const& module_script) -> void { // onSingleFetchComplete given moduleScript is the following algorithm: // 1. Let completion be null. // NOTE: Our JS::Completion does not support non JS::Value types for its [[Value]], a such we diff --git a/Userland/Libraries/LibWeb/HTML/Scripting/Fetching.cpp b/Userland/Libraries/LibWeb/HTML/Scripting/Fetching.cpp index e0b85df9e2..09cc4fa4ba 100644 --- a/Userland/Libraries/LibWeb/HTML/Scripting/Fetching.cpp +++ b/Userland/Libraries/LibWeb/HTML/Scripting/Fetching.cpp @@ -793,7 +793,7 @@ void fetch_descendants_of_and_link_a_module_script(JS::Realm& realm, }); // 7. Upon rejection of loadingPromise, run the following steps: - WebIDL::upon_rejection(loading_promise, [&state, &module_script, on_complete](auto const&) -> WebIDL::ExceptionOr { + WebIDL::upon_rejection(loading_promise, [state, &module_script, on_complete](auto const&) -> WebIDL::ExceptionOr { // 1. If state.[[ParseError]] is not null, set moduleScript's error to rethrow to state.[[ParseError]] and run // onComplete given moduleScript. if (!state->parse_error.is_null()) {