Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-12-14 02:31:59 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fixing rtm++ bug 54121. Make sure to unroot the JS object before setting the script object to null to avoid referencing deleted memory later on in the GC. Thanks to sean@beatnik.com for testing and helping with the patch. a=waterson, r=brendan

Browse Source
This commit is contained in:
jst%netscape.com 2000-10-17 21:19:26 +00:00
parent 3c15c15513
commit 1e5f75e727
2 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
content/html/content/src/nsHTMLEmbedElement.cpp
View File

@ -348,6 +348,14 @@ nsHTMLEmbedElement::GetScriptObject(nsIScriptContext* aContext,
// don't cache it so that the next call can get the correct script object
// if the plugin instance is available at the next call.
if (NS_FAILED(rv)) {
if (mInner.mDocument) {
// Since we're resetting the script object to null we'll remove the
// reference to it so that we won't add the same named reference
// again the next time someone requests the script object.
aContext->RemoveReference((void *)&mInner.mDOMSlots->mScriptObject,
mInner.mDOMSlots->mScriptObject);
}
mInner.SetScriptObject(nsnull);
*aScriptObject = elementObject;

8
layout/html/content/src/nsHTMLEmbedElement.cpp
View File

@ -348,6 +348,14 @@ nsHTMLEmbedElement::GetScriptObject(nsIScriptContext* aContext,
// don't cache it so that the next call can get the correct script object
// if the plugin instance is available at the next call.
if (NS_FAILED(rv)) {
if (mInner.mDocument) {
// Since we're resetting the script object to null we'll remove the
// reference to it so that we won't add the same named reference
// again the next time someone requests the script object.
aContext->RemoveReference((void *)&mInner.mDOMSlots->mScriptObject,
mInner.mDOMSlots->mScriptObject);
}
mInner.SetScriptObject(nsnull);
*aScriptObject = elementObject;