[webkit-changes] [WebKit/WebKit] 1457c8: Regression(265870.536 at safari-7616-branch) Crashes ...

[Chris Dumez]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 1457c8d75c8fb91a65e20bf64ddf13749e73ab68
      https://github.com/WebKit/WebKit/commit/1457c8d75c8fb91a65e20bf64ddf13749e73ab68
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2023-11-02 (Thu, 02 Nov 2023)

  Changed paths:
    A LayoutTests/webaudio/promise-resolution-crash-expected.txt
    A LayoutTests/webaudio/promise-resolution-crash.html
    M Source/WebCore/bindings/js/JSDOMPromiseDeferred.cpp

  Log Message:
  -----------
  Regression(265870.536 at safari-7616-branch) Crashes under DeferredPromise::callFunction()
https://bugs.webkit.org/show_bug.cgi?id=261829
rdar://115712299

Reviewed by Brent Fulgham and Mark Lam.

The RELEASE_ASSERT() added by  Ryosuke in 265870.536 at safari-7616-branch in DeferredPromise::callFunction()
is hitting a lot in the wild, from various call sites. The assertion makes sure we're allowed to run
script when resolving a promise (i.e. we're not in the middle of layout or style resolution).

* LayoutTests/webaudio/promise-resolution-crash-expected.txt: Added.
* LayoutTests/webaudio/promise-resolution-crash.html: Added.
New test coverage.

* Source/WebCore/bindings/js/JSDOMPromiseDeferred.cpp:
(WebCore::DeferredPromise::callFunction):
Drop the release assertion and instead schedule a task to resolve the promise
asynchronously when we're not allowed to run script, similarly to what we were
already doing when b/f cache suspended.

Originally-landed-as: 265870.579 at safari-7616-branch (587ed3048a75). rdar://117810995
Canonical link: https://commits.webkit.org/270157@main