tor-browser

commit 78b6d650695f1f3c70b2cc7ea230fb54e33b6bad
parent 882470344ade90bf2efd13e4105aa971fd86b470
Author: Matthew Gaudet <mgaudet@mozilla.com>
Date:   Fri, 12 Dec 2025 21:55:25 +0000

Bug 2005449 - Handle failure to unwrap JS microtask r=bthrall

Differential Revision: https://phabricator.services.mozilla.com/D276039

Diffstat:
A
js/src/jit-test/tests/js_microtask/dead-job.js
 | 
23
+++++++++++++++++++++++
M
js/src/shell/js.cpp
 | 
8
+++++++-

2 files changed, 30 insertions(+), 1 deletion(-)
diff --git a/js/src/jit-test/tests/js_microtask/dead-job.js b/js/src/jit-test/tests/js_microtask/dead-job.js
@@ -0,0 +1,23 @@
+function b(global) {
+    var resolve;
+    new Promise(d => resolve = d).then(global.Function)
+    resolve()
+
+    caught = false;
+    try {
+        globalOfFirstJobInQueue()
+    } catch (exception) {
+        caught = true;
+        assertEq(exception.message.includes("dead object"), true);
+    }
+    assertEq(caught, true);
+}
+
+let g1 = newGlobal()
+let g2 = newGlobal({
+    newCompartment: true
+})
+
+nukeAllCCWs()
+
+b(g2)
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
@@ -1519,7 +1519,13 @@ static bool GlobalOfFirstJobInQueue(JSContext* cx, unsigned argc, Value* vp) {
 
     auto& genericJob = cx->microTaskQueues->microTaskQueue.front();
     JS::JSMicroTask* job = JS::ToUnwrappedJSMicroTask(genericJob);
-    MOZ_ASSERT(job);
+    if (!job) {
+      JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
+                                JSMSG_DEAD_OBJECT);
+
+      return false;
+    }
+
     RootedObject global(cx, JS::GetExecutionGlobalFromJSMicroTask(job));
     if (!global) {
       JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,