tor-browser

commit b59ff82f68bfd7993040b334b63f78b760c76c63
parent fbaed19437a7b78456f27ebe78042714245c8d0b
Author: Julien Pages <jpages@mozilla.com>
Date:   Wed,  5 Nov 2025 03:53:46 +0000

Bug 1996446 - wasm: Avoid a suspender error when unwinding a promise. r=yury

Differential Revision: https://phabricator.services.mozilla.com/D270739

Diffstat:
A
js/src/jit-test/tests/wasm/js-promise-integration/suspender.js
 | 
16
++++++++++++++++
M
js/src/wasm/WasmPI.cpp
 | 
6
+++++-

2 files changed, 21 insertions(+), 1 deletion(-)
diff --git a/js/src/jit-test/tests/wasm/js-promise-integration/suspender.js b/js/src/jit-test/tests/wasm/js-promise-integration/suspender.js
@@ -0,0 +1,16 @@
+
+var ins = wasmEvalText(`
+(module
+  (func (export "w0") (param nullexternref)
+  )
+)`);
+let v2 = WebAssembly.promising(ins.exports.w0);
+
+var res = WebAssembly.promising(ins.exports.w0);
+Promise.resolve().then(() => {
+  res().then(i => {
+    assertEq(42, i)
+  }).catch(e => {
+    assertEq(e instanceof TypeError, true);
+  });
+});
diff --git a/js/src/wasm/WasmPI.cpp b/js/src/wasm/WasmPI.cpp
@@ -1714,7 +1714,11 @@ static bool WasmPIPromisingFunction(JSContext* cx, unsigned argc, Value* vp) {
   }
 
   // During an exception the stack was unwound -- time to release resources.
-  CleanupActiveSuspender(cx);
+  // At this point, the suspender might be null, if that's the case
+  // don't try to clean up.
+  if (cx->wasm().promiseIntegration.activeSuspender() != nullptr) {
+    CleanupActiveSuspender(cx);
+  }
 
   if (cx->isThrowingOutOfMemory()) {
     return false;