From 12d28dffc6c8d08e6620751e55d8a382c66443a2 Mon Sep 17 00:00:00 2001 From: Andreu Botella Date: Tue, 22 Mar 2022 11:33:29 +0100 Subject: fix(fetch): Fix uncaught rejection panic with `WebAssembly.instantiateStreaming` (#13925) When an exception is thrown during the processing of streaming WebAssembly, `op_wasm_streaming_abort` is called. This op calls into V8, which synchronously rejects the promise and calls into the promise rejection handler, if applicable. But calling an op borrows the isolate's `JsRuntimeState` for the duration of the op, which means it is borrowed when V8 calls into `promise_reject_callback`, which tries to borrow it again, panicking. This change changes `op_wasm_streaming_abort` from an op to a binding (`Deno.core.abortWasmStreaming`). Although that binding must borrow the `JsRuntimeState` in order to access the `WasmStreamingResource` stored in the `OpTable`, it also takes ownership of that `WasmStreamingResource` instance, which means it can drop any borrows of the `JsRuntimeState` before calling into V8. --- cli/tests/testdata/wasm_streaming_panic_test.js | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 cli/tests/testdata/wasm_streaming_panic_test.js (limited to 'cli/tests/testdata/wasm_streaming_panic_test.js') diff --git a/cli/tests/testdata/wasm_streaming_panic_test.js b/cli/tests/testdata/wasm_streaming_panic_test.js new file mode 100644 index 000000000..ec017592f --- /dev/null +++ b/cli/tests/testdata/wasm_streaming_panic_test.js @@ -0,0 +1,3 @@ +// https://github.com/denoland/deno/issues/13917 + +WebAssembly.instantiateStreaming(Response.error()); -- cgit v1.2.3