RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 11:38:11 +00:00
Code Issues Activity Actions

LibWeb: Fix two bad capture-by-reference bugs caught by ASAN

Browse source 
In both cases, related to fetching/loading modules.
This commit is contained in:
Andreas Kling 2023-12-03 15:15:35 +01:00
parent 62361e40a1
commit c0bacc6c4b
2 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Userland/Libraries/LibWeb/Bindings/MainThreadVM.cpp
View file

@ -475,7 +475,7 @@ ErrorOr<void> initialize_main_thread_vm()
fetch_client = fetch_context.fetch_client;
}
auto on_single_fetch_complete = HTML::create_on_fetch_script_complete(realm.heap(), [referrer, &realm, load_state, &module_request, payload](JS::GCPtr<HTML::Script> const& module_script) -> void {
auto on_single_fetch_complete = HTML::create_on_fetch_script_complete(realm.heap(), [referrer, &realm, load_state, module_request, payload](JS::GCPtr<HTML::Script> const& module_script) -> void {
// onSingleFetchComplete given moduleScript is the following algorithm:
// 1. Let completion be null.
// NOTE: Our JS::Completion does not support non JS::Value types for its [[Value]], a such we

2
Userland/Libraries/LibWeb/HTML/Scripting/Fetching.cpp
View file

@ -793,7 +793,7 @@ void fetch_descendants_of_and_link_a_module_script(JS::Realm& realm,
});
// 7. Upon rejection of loadingPromise, run the following steps:
WebIDL::upon_rejection(loading_promise, [&state, &module_script, on_complete](auto const&) -> WebIDL::ExceptionOr<JS::Value> {
WebIDL::upon_rejection(loading_promise, [state, &module_script, on_complete](auto const&) -> WebIDL::ExceptionOr<JS::Value> {
// 1. If state.[[ParseError]] is not null, set moduleScript's error to rethrow to state.[[ParseError]] and run
// onComplete given moduleScript.
if (!state->parse_error.is_null()) {