haikuwebkit/LayoutTests/fast/xmlhttprequest/xmlhttprequest-upload-sameo...

20 lines
370 B
HTML
Raw Permalink Normal View History

Fix unsafe access to m_upload in XMLHttpRequest::virtualHasPendingActivity() https://bugs.webkit.org/show_bug.cgi?id=226508 Reviewed by Geoffrey Garen. Source/WebCore: Fix unsafe access to m_upload in XMLHttpRequest::virtualHasPendingActivity() as virtualHasPendingActivity() may get called off the main thread and m_upload gets initialized lazily on the main thread. Tests: fast/xmlhttprequest/xmlhttprequest-upload-sameobject.html http/tests/xmlhttprequest/upload-progress-events-gc.html * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::updateHasRelevantEventListener): (WebCore::XMLHttpRequest::eventListenersDidChange): (WebCore::XMLHttpRequest::virtualHasPendingActivity const): * xml/XMLHttpRequest.h: * xml/XMLHttpRequest.idl: * xml/XMLHttpRequestUpload.cpp: (WebCore::XMLHttpRequestUpload::eventListenersDidChange): (WebCore::XMLHttpRequestUpload::hasRelevantEventListener const): * xml/XMLHttpRequestUpload.h: LayoutTests: Improve layout test coverage to make sure that XMLHttpRequest.upload always returns the same object and that progress events on XMLHttpRequest.upload still get fired after GC. * fast/xmlhttprequest/xmlhttprequest-upload-sameobject-expected.txt: Added. * fast/xmlhttprequest/xmlhttprequest-upload-sameobject.html: Added. * http/tests/xmlhttprequest/upload-progress-events-gc-expected.txt: Added. * http/tests/xmlhttprequest/upload-progress-events-gc.html: Added. Canonical link: https://commits.webkit.org/238362@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@278329 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2021-06-01 22:03:35 +00:00
<DOCTYPE html>
<html>
<body>
<script src="../../resources/js-test.js"></script>
<script>
description("Tests that XMLHttpRequest.upload always returns the same object.");
jsTestIsAsync = true;
let xhr = new XMLHttpRequest();
xhr.upload.foo = 1;
gc();
setTimeout(() => {
gc();
shouldBe("xhr.upload.foo", "1");
finishJSTest();
}, 0);
</script>
</body>
</html>