Fix crash

oven-sh · Aug 2, 2024 · 5bda985 · 5bda985
1 parent 5388fcf
commit 5bda985
Showing 1 changed file with 12 additions and 5 deletions.
diff --git a/Source/JavaScriptCore/runtime/DeferredWorkTimer.cpp b/Source/JavaScriptCore/runtime/DeferredWorkTimer.cpp
@@ -224,20 +224,27 @@ void DeferredWorkTimer::scheduleWorkSoon(Ticket ticket, Task&& task)
 // https://bugs.webkit.org/show_bug.cgi?id=276538
 bool DeferredWorkTimer::cancelPendingWork(Ticket ticket)
 {
-    ASSERT(m_pendingTickets.contains(ticket));
+#if ASSERT_ENABLED
+    if (!onCancelPendingWork) {
+        ASSERT(m_pendingTickets.contains(ticket));
+    }
+#endif
+
     ASSERT(ticket->isCancelled() || ticket->vm().currentThreadIsHoldingAPILock() || (Thread::mayBeGCThread() && ticket->vm().heap.worldIsStopped()));
 
     bool result = false;
     if (!ticket->isCancelled()) {
+        // Script execution context is cleared in ->cancel().
+        // So we have to call onCancelPendingWork before canceling the ticket.
+        if (onCancelPendingWork) {
+            onCancelPendingWork(ticket);
+        }
+
         dataLogLnIf(DeferredWorkTimerInternal::verbose, "Canceling ticket: ", RawPointer(ticket));
         ticket->cancel();
         result = true;
     }
 
-     if (onCancelPendingWork) {
-        onCancelPendingWork(ticket);
-    }
-
     return result;
 }