Files
tubestation/dom/workers
Eden Chuang 113e7b3116 Bug 1905337 - Keep dispatched RefPtr<WorkerThreadRunnable> of WorkerPrivate::mPreStartRunnables. r=dom-worker-reviewers,jstutte,smaug
https://phabricator.services.mozilla.com/D213947 introduced a post-handling for WorkerPrivate::mPreStartRunnables once Worker initialization fails.
However, it needs corresponding WorkerThreadRunnable be kept in WorkerPrivate::mPreStartRunnables. However, [[ https://searchfox.org/mozilla-central/rev/3d173a6ad865eb778eb7a85de900e92774559ed6/dom/workers/WorkerPrivate.cpp#5928 | we did not keep it while dispatching]], and then meet UAF when executing the post-handling.

So this patch ensures the mPreStartRunnables are kept after dispatching.
And mPreStartRunnables will be cleared [[ https://searchfox.org/mozilla-central/rev/3d173a6ad865eb778eb7a85de900e92774559ed6/dom/workers/WorkerPrivate.cpp#3273,3336 | when the Worker gets into the next status "Running" or "Dead"]].

Differential Revision: https://phabricator.services.mozilla.com/D215601
2024-07-03 09:59:16 +00:00
..