fix(websocket): add missing incPendingActivityCount() in blob binaryType case

Fixes #26669

The Blob case in `didReceiveBinaryData` was calling `decPendingActivityCount()`
inside the `postTask` callback without a matching `incPendingActivityCount()`
beforehand. This caused a crash ("Pure virtual function called!") when the
WebSocket client received binary data (like ping frames) with `binaryType =
"blob"` and no corresponding event listener attached.

The bug was introduced in #21471 when Blob support was added. The ArrayBuffer
and NodeBuffer cases correctly call `incPendingActivityCount()` before
`postTask`, but the Blob case was missing this call.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Claude Bot
2026-02-01 13:22:17 +00:00
parent a14a89ca95
commit 5432a07bbc
2 changed files with 81 additions and 0 deletions

View File

@@ -1323,6 +1323,7 @@ void WebSocket::didReceiveBinaryData(const AtomString& eventName, const std::spa
if (auto* context = scriptExecutionContext()) {
RefPtr<Blob> blob = Blob::create(binaryData, context->jsGlobalObject());
this->incPendingActivityCount();
context->postTask([this, name = eventName, blob = blob.releaseNonNull(), protectedThis = Ref { *this }](ScriptExecutionContext& context) {
ASSERT(scriptExecutionContext());
protectedThis->dispatchEvent(MessageEvent::create(name, blob, protectedThis->m_url.string()));