tor-browser

commit 7921495c59257f74f749d1182e1cc6cc3237d849
parent dc35d5534a85d9a4760637ab224922ef0c8d9dcc
Author: Matthew Gaudet <mgaudet@mozilla.com>
Date:   Mon, 15 Dec 2025 20:06:22 +0000

Bug 2005449 - Handle failure to unwrap JS microtask r=bthrall

Differential Revision: https://phabricator.services.mozilla.com/D276039

Diffstat:
A
js/src/jit-test/tests/js_microtask/dead-job.js
 | 
23
+++++++++++++++++++++++
M
js/src/shell/js.cpp
 | 
8
+++++++-

2 files changed, 30 insertions(+), 1 deletion(-)
diff --git a/js/src/jit-test/tests/js_microtask/dead-job.js b/js/src/jit-test/tests/js_microtask/dead-job.js
@@ -0,0 +1,23 @@
+function b(global) {
+    var resolve;
+    new Promise(d => resolve = d).then(global.Function)
+    resolve()
+
+    globalOfFirstJobInQueue()
+}
+
+let g1 = newGlobal()
+let g2 = newGlobal({
+    newCompartment: true
+})
+
+nukeAllCCWs()
+
+caught = false;
+try {
+    b(g2)
+} catch (exception) {
+    caught = true;
+    assertEq(exception.message.includes("dead object"), true);
+}
+assertEq(caught, true);
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
@@ -1519,7 +1519,13 @@ static bool GlobalOfFirstJobInQueue(JSContext* cx, unsigned argc, Value* vp) {
 
     auto& genericJob = cx->microTaskQueues->microTaskQueue.front();
     JS::JSMicroTask* job = JS::ToUnwrappedJSMicroTask(genericJob);
-    MOZ_ASSERT(job);
+    if (!job) {
+      JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
+                                JSMSG_DEAD_OBJECT);
+
+      return false;
+    }
+
     RootedObject global(cx, JS::GetExecutionGlobalFromJSMicroTask(job));
     if (!global) {
       JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,