diff options
| -rw-r--r-- | chromium/third_party/blink/renderer/modules/webusb/usb.cc | 15 | ||||
| -rw-r--r-- | chromium/third_party/blink/renderer/modules/webusb/usb_device.cc | 8 |
2 files changed, 17 insertions, 6 deletions
diff --git a/chromium/third_party/blink/renderer/modules/webusb/usb.cc b/chromium/third_party/blink/renderer/modules/webusb/usb.cc index cbe336ae699..ce38760e569 100644 --- a/chromium/third_party/blink/renderer/modules/webusb/usb.cc +++ b/chromium/third_party/blink/renderer/modules/webusb/usb.cc @@ -264,15 +264,22 @@ void USB::OnDeviceRemoved(UsbDeviceInfoPtr device_info) { void USB::OnServiceConnectionError() { service_.reset(); client_receiver_.reset(); - for (ScriptPromiseResolver* resolver : get_devices_requests_) + + // Move the set to a local variable to prevent script execution in Resolve() + // from invalidating the iterator used by the loop. + HeapHashSet<Member<ScriptPromiseResolver>> get_devices_requests; + get_devices_requests.swap(get_devices_requests_); + for (auto& resolver : get_devices_requests) resolver->Resolve(HeapVector<Member<USBDevice>>(0)); - get_devices_requests_.clear(); - for (ScriptPromiseResolver* resolver : get_permission_requests_) { + // Move the set to a local variable to prevent script execution in Reject() + // from invalidating the iterator used by the loop. + HeapHashSet<Member<ScriptPromiseResolver>> get_permission_requests; + get_permission_requests.swap(get_permission_requests_); + for (auto& resolver : get_permission_requests) { resolver->Reject(MakeGarbageCollected<DOMException>( DOMExceptionCode::kNotFoundError, kNoDeviceSelected)); } - get_permission_requests_.clear(); } void USB::AddedEventListener(const AtomicString& event_type, diff --git a/chromium/third_party/blink/renderer/modules/webusb/usb_device.cc b/chromium/third_party/blink/renderer/modules/webusb/usb_device.cc index da7d3003c3a..23856abc9a5 100644 --- a/chromium/third_party/blink/renderer/modules/webusb/usb_device.cc +++ b/chromium/third_party/blink/renderer/modules/webusb/usb_device.cc @@ -1099,11 +1099,15 @@ void USBDevice::AsyncReset(ScriptPromiseResolver* resolver, bool success) { void USBDevice::OnConnectionError() { device_.reset(); opened_ = false; - for (ScriptPromiseResolver* resolver : device_requests_) { + + // Move the set to a local variable to prevent script execution in Reject() + // from invalidating the iterator used by the loop. + HeapHashSet<Member<ScriptPromiseResolver>> device_requests; + device_requests.swap(device_requests_); + for (auto& resolver : device_requests) { resolver->Reject(MakeGarbageCollected<DOMException>( DOMExceptionCode::kNotFoundError, kDeviceDisconnected)); } - device_requests_.clear(); } bool USBDevice::MarkRequestComplete(ScriptPromiseResolver* resolver) { |