ladybird/Tests/LibWeb/Crash/JS/finalization-registry-proxy-callback.html
Tim Ledbetter 5a33062ba9 LibWeb: Use GetFunctionRealm for FinalizationRegistry cleanup callbacks
The callback passed to `FinalizationRegistry` may be a Proxy or
BoundFunction, which lack a `[[Realm]]` internal slot. Dereferencing
the callback realm directly returned null and led to a crash in
`HostEnqueueFinalizationRegistryCleanupJob`. We now use the
`GetFunctionRealm` AO to unwrap these exotic objects and find the
underlying realm.
2026-05-26 01:27:55 +02:00

12 lines
260 B
HTML

<!DOCTYPE html>
<script src="../../Text/input/include.js"></script>
<script>
const callback = new Proxy(function() {}, {});
const registry = new FinalizationRegistry(callback);
(function() {
registry.register({}, "held");
})();
internals.gc();
</script>