dom: Avoid panic when SpiderMonkey enqueues dummy promise jobs.

servo · bors-servo · Jun 17, 2020 · Jun 16, 2020 · Jun 16, 2020 · 2e4cee99710a5745adf2bd1df185adcd36e5104f
commit 2e4cee99710a5745adf2bd1df185adcd36e5104f
diff --git a/components/script/script_runtime.rs b/components/script/script_runtime.rs
@@ -206,7 +206,12 @@ unsafe extern "C" fn enqueue_promise_job(
     let mut result = false;
     wrap_panic(&mut || {
         let microtask_queue = &*(extra as *const MicrotaskQueue);
-        let global = GlobalScope::from_object(incumbent_global.get());
+        let global = if !incumbent_global.is_null() {
+            GlobalScope::from_object(incumbent_global.get())
+        } else {
+            let realm = AlreadyInRealm::assert_for_cx(cx);
+            GlobalScope::from_context(*cx, InRealm::in_realm(&realm))
+        };
         let pipeline = global.pipeline_id();
         let interaction = if promise.get().is_null() {
             PromiseUserInputEventHandlingState::DontCare

diff --git a/tests/wpt/mozilla/meta/MANIFEST.json b/tests/wpt/mozilla/meta/MANIFEST.json
@@ -14215,6 +14215,13 @@
       {}
      ]
     ],
+    "promise-no-incumbent.html": [
+     "a5458d096b5da8d6619ef5c553f232261887f45a",
+     [
+      null,
+      {}
+     ]
+    ],
     "promise.html": [
      "5925047287175f291c07ee88075359ed92a86e6a",
      [

diff --git a/tests/wpt/mozilla/tests/mozilla/promise-no-incumbent.html b/tests/wpt/mozilla/tests/mozilla/promise-no-incumbent.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+  promise_test(function(t) {
+      let p = new Promise((r) => t.step_timeout(r, 0));
+      p.then = function() {};
+      let p2 = new Promise((r) => t.step_timeout(r, 10));
+      return Promise.race([p, p2]);
+  }, 'No panic when SM puts a dummy promise with no incumbent in the queue');
+</script>