Skip to content

[Fizz] Fix crash when capturing the callsite of a stalled use() of a Flight chunk that was rejected in the meantime#36544

Merged
eps1lon merged 2 commits into
facebook:mainfrom
lubieowoce:fix-stalled-use-of-rejected-flight
May 26, 2026
Merged

[Fizz] Fix crash when capturing the callsite of a stalled use() of a Flight chunk that was rejected in the meantime#36544
eps1lon merged 2 commits into
facebook:mainfrom
lubieowoce:fix-stalled-use-of-rejected-flight

Conversation

@lubieowoce
Copy link
Copy Markdown
Contributor

@lubieowoce lubieowoce commented May 26, 2026

ensureSuspendableThenableStateDEV patches then in fulfilled thenables to avoid triggering a custom thenable's then in an unexpected state. However, we weren't doing the same for rejected thenables.

This affected ReactPromise, the type used for thenables passed from server to client. if a ReactPromise passed to use was pending during the render but became rejected between the abort and pushSuspendedCallSiteOnComponentStack, then ReactPromise#then would crash. (see the added test for a reprouction)
This is because we were putting the ReactPromise into an invalid state: a PendingChunk expects to have a value: null | Array<...>, but we were deleting value altogether, and tgus hitting TypeError: can't access property "push" of undefined here:

chunk.value.push(resolve);

Bypassing the suspended thenable's then avoids this crash.

…Flight chunk that was rejected in the meantime
@meta-cla meta-cla Bot added the CLA Signed label May 26, 2026
@react-sizebot
Copy link
Copy Markdown

react-sizebot commented May 26, 2026

Comparing: 926fa85...f8abac7

Critical size changes

Includes critical production bundles, as well as any change greater than 2%:

Name +/- Base Current +/- gzip Base gzip Current gzip
oss-stable/react-dom/cjs/react-dom.production.js = 6.84 kB 6.84 kB = 1.88 kB 1.88 kB
oss-stable/react-dom/cjs/react-dom-client.production.js = 614.17 kB 614.17 kB = 108.52 kB 108.52 kB
oss-experimental/react-dom/cjs/react-dom.production.js = 6.84 kB 6.84 kB = 1.88 kB 1.88 kB
oss-experimental/react-dom/cjs/react-dom-client.production.js = 680.11 kB 680.11 kB = 119.48 kB 119.48 kB
facebook-www/ReactDOM-prod.classic.js = 700.53 kB 700.53 kB = 123.05 kB 123.06 kB
facebook-www/ReactDOM-prod.modern.js = 690.84 kB 690.84 kB = 121.44 kB 121.44 kB

Significant size changes

Includes any change greater than 0.2%:

(No significant changes)

Generated by 🚫 dangerJS against f8abac7

@lubieowoce lubieowoce marked this pull request as ready for review May 26, 2026 19:02
@eps1lon eps1lon merged commit 37fa36c into facebook:main May 26, 2026
240 checks passed
github-actions Bot pushed a commit that referenced this pull request May 26, 2026
…Flight chunk that was rejected in the meantime (#36544)

`ensureSuspendableThenableStateDEV` patches `then` in fulfilled
thenables to avoid triggering a custom thenable's `then` in an
unexpected state. However, we weren't doing the same for rejected
thenables.

This affected `ReactPromise`, the type used for thenables passed from
server to client. if a `ReactPromise` passed to `use` was pending during
the render but became rejected between the abort and
`pushSuspendedCallSiteOnComponentStack`, then `ReactPromise#then` would
crash. (see the added test for a reprouction)
This is because we were putting the ReactPromise into an invalid state:
a `PendingChunk` expects to have a `value: null | Array<...>`, but we
were deleting `value` altogether, and tgus hitting `TypeError: can't
access property "push" of undefined` here:

https://github.com/facebook/react/blob/75b0945b18f4a60c80c931fd8067d9c715957879/packages/react-client/src/ReactFlightClient.js#L309
Bypassing the suspended thenable's `then` avoids this crash.

DiffTrain build for [37fa36c](37fa36c)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants