From 12d28dffc6c8d08e6620751e55d8a382c66443a2 Mon Sep 17 00:00:00 2001 From: Andreu Botella Date: Tue, 22 Mar 2022 11:33:29 +0100 Subject: fix(fetch): Fix uncaught rejection panic with `WebAssembly.instantiateStreaming` (#13925) When an exception is thrown during the processing of streaming WebAssembly, `op_wasm_streaming_abort` is called. This op calls into V8, which synchronously rejects the promise and calls into the promise rejection handler, if applicable. But calling an op borrows the isolate's `JsRuntimeState` for the duration of the op, which means it is borrowed when V8 calls into `promise_reject_callback`, which tries to borrow it again, panicking. This change changes `op_wasm_streaming_abort` from an op to a binding (`Deno.core.abortWasmStreaming`). Although that binding must borrow the `JsRuntimeState` in order to access the `WasmStreamingResource` stored in the `OpTable`, it also takes ownership of that `WasmStreamingResource` instance, which means it can drop any borrows of the `JsRuntimeState` before calling into V8. --- ext/fetch/26_fetch.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'ext/fetch/26_fetch.js') diff --git a/ext/fetch/26_fetch.js b/ext/fetch/26_fetch.js index bbcbb44f0..711825985 100644 --- a/ext/fetch/26_fetch.js +++ b/ext/fetch/26_fetch.js @@ -556,7 +556,7 @@ core.close(rid); } catch (err) { // 2.8 and 3 - core.opSync("op_wasm_streaming_abort", rid, err); + core.abortWasmStreaming(rid, err); } })(); } -- cgit v1.2.3