tor-browser

commit f5d6b399d3923b20758d0eff198984ca21adbb58
parent b23df1ad9a68e880cd2449c2e10f9f40e20156c5
Author: Tooru Fujisawa <arai_a@mac.com>
Date:   Wed, 19 Nov 2025 10:53:32 +0000

Bug 2000587 - Part 2: Check dead wrapper in JS::RunJSMicroTask. r=iain

Differential Revision: https://phabricator.services.mozilla.com/D272981

Diffstat:
M
js/src/builtin/Promise.cpp
 | 
9
+++++----

1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
@@ -7642,14 +7642,15 @@ JS_PUBLIC_API bool JS::RunJSMicroTask(JSContext* cx,
                                       Handle<JS::JSMicroTask*> entry) {
 #ifdef DEBUG
   JSObject* global = JS::GetExecutionGlobalFromJSMicroTask(entry);
-  MOZ_ASSERT(global == cx->global());
+  MOZ_ASSERT_IF(global, global == cx->global());
 #endif
 
   RootedObject task(cx, entry);
-  MOZ_ASSERT(!JS_IsDeadWrapper(task));
-
   RootedObject unwrappedTask(cx, UncheckedUnwrap(entry));
-  MOZ_ASSERT(unwrappedTask);
+  if (JS_IsDeadWrapper(unwrappedTask)) {
+    JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_DEAD_OBJECT);
+    return false;
+  }
 
   if (unwrappedTask->is<PromiseReactionRecord>()) {
     // Note: We don't store a callback for promise reaction records because they