Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Use-after-free in processResponse in ServiceWorkerFetch.cpp
rdar://118039950 Reviewed by Chris Dumez. Cancelling the stream can trigger GC when creating the DOMException JS wrapper. This might collect the FetchResponse object. To make sure the FetchResponse object stays live for the whole time, we protect it in the callback. * Source/WebCore/workers/service/context/ServiceWorkerFetch.cpp: (WebCore::ServiceWorkerFetch::processResponse): Originally-landed-as: 267815.569@safari-7617-branch (5ebdf97). rdar://121481543 Canonical link: https://commits.webkit.org/273420@main
- Loading branch information