mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-11-24 21:31:04 +00:00
Bug 697643 - Crash [@ JS_IsExceptionPending] modifying a live NodeList. r=bz.
--HG-- extra : rebase_source : 1d2e5e17c76a04a88468d976e89576d127e4e54f
This commit is contained in:
parent
f4c64c3c0e
commit
451166e8e7
5
dom/base/crashtests/697643.html
Normal file
5
dom/base/crashtests/697643.html
Normal file
@ -0,0 +1,5 @@
|
||||
<script>
|
||||
|
||||
document.createElementNS('http://www.w3.org/1999/xhtml', 'select').options[0] = {};
|
||||
|
||||
</script>
|
@ -30,3 +30,4 @@ load 637116.html
|
||||
load 666869.html
|
||||
load 675621-1.html
|
||||
load 693894.html
|
||||
load 697643.html
|
||||
|
@ -313,7 +313,7 @@ ListBase<LC>::getItemAt(ListType *list, uint32 i, IndexGetterType &item)
|
||||
|
||||
template<class LC>
|
||||
bool
|
||||
ListBase<LC>::setItemAt(ListType *list, uint32 i, IndexSetterType item)
|
||||
ListBase<LC>::setItemAt(JSContext *cx, ListType *list, uint32 i, IndexSetterType item)
|
||||
{
|
||||
JS_STATIC_ASSERT(!hasIndexSetter);
|
||||
return false;
|
||||
@ -329,7 +329,8 @@ ListBase<LC>::getNamedItem(ListType *list, const nsAString& aName, NameGetterTyp
|
||||
|
||||
template<class LC>
|
||||
bool
|
||||
ListBase<LC>::setNamedItem(ListType *list, const nsAString& aName, NameSetterType item)
|
||||
ListBase<LC>::setNamedItem(JSContext *cx, ListType *list, const nsAString& aName,
|
||||
NameSetterType item)
|
||||
{
|
||||
JS_STATIC_ASSERT(!hasNameSetter);
|
||||
return false;
|
||||
@ -687,7 +688,7 @@ ListBase<LC>::defineProperty(JSContext *cx, JSObject *proxy, jsid id, PropertyDe
|
||||
IndexSetterType value;
|
||||
jsval v;
|
||||
return Unwrap(cx, desc->value, &value, getter_AddRefs(ref), &v) &&
|
||||
setItemAt(getListObject(proxy), index, value);
|
||||
setItemAt(cx, getListObject(proxy), index, value);
|
||||
}
|
||||
}
|
||||
|
||||
@ -704,8 +705,7 @@ ListBase<LC>::defineProperty(JSContext *cx, JSObject *proxy, jsid id, PropertyDe
|
||||
jsval v;
|
||||
if (!Unwrap(cx, desc->value, &value, getter_AddRefs(ref), &v))
|
||||
return false;
|
||||
if (setNamedItem(getListObject(proxy), nameString, value))
|
||||
return true;
|
||||
return setNamedItem(cx, getListObject(proxy), nameString, value);
|
||||
}
|
||||
|
||||
if (xpc::WrapperFactory::IsXrayWrapper(proxy))
|
||||
|
@ -193,13 +193,14 @@ private:
|
||||
static JSBool length_getter(JSContext *cx, JSObject *obj, jsid id, jsval *vp);
|
||||
|
||||
static inline bool getItemAt(ListType *list, uint32 i, IndexGetterType &item);
|
||||
static inline bool setItemAt(ListType *list, uint32 i, IndexSetterType item);
|
||||
static inline bool setItemAt(JSContext *cx, ListType *list, uint32 i, IndexSetterType item);
|
||||
|
||||
static inline bool namedItem(JSContext *cx, JSObject *obj, jsval *name, NameGetterType &result,
|
||||
bool *hasResult);
|
||||
|
||||
static inline bool getNamedItem(ListType *list, const nsAString& aName, NameGetterType &item);
|
||||
static inline bool setNamedItem(ListType *list, const nsAString& aName, NameSetterType item);
|
||||
static inline bool setNamedItem(JSContext *cx, ListType *list, const nsAString& aName,
|
||||
NameSetterType item);
|
||||
|
||||
static bool getPropertyOnPrototype(JSContext *cx, JSObject *proxy, jsid id, bool *found,
|
||||
js::Value *vp);
|
||||
|
@ -141,7 +141,7 @@ class DOMClass(UserDict.DictMixin):
|
||||
template = (" !; // TODO")
|
||||
else:
|
||||
template = (" nsresult rv = list->%s(index, item);\n"
|
||||
" return NS_SUCCEEDED(rv) ? true : Throw(nsnull, rv);\n")
|
||||
" return NS_SUCCEEDED(rv) ? true : Throw(cx, rv);\n")
|
||||
|
||||
return template % header.methodNativeName(setter)
|
||||
|
||||
@ -503,7 +503,7 @@ indexGetterTemplate = (
|
||||
indexSetterTemplate = (
|
||||
"template<>\n"
|
||||
"bool\n"
|
||||
"${name}Wrapper::setItemAt(${nativeClass} *list, uint32 index, ${indexSetterType} item)\n"
|
||||
"${name}Wrapper::setItemAt(JSContext *cx, ${nativeClass} *list, uint32 index, ${indexSetterType} item)\n"
|
||||
"{\n"
|
||||
"${indexSet}"
|
||||
"}\n"
|
||||
@ -521,7 +521,7 @@ nameGetterTemplate = (
|
||||
nameSetterTemplate = (
|
||||
"template<>\n"
|
||||
"bool\n"
|
||||
"${name}Wrapper::setNamedItem(${nativeClass} *list, const nsAString& index, ${nameSetterType} item)\n"
|
||||
"${name}Wrapper::setNamedItem(JSContext *cx, ${nativeClass} *list, const nsAString& index, ${nameSetterType} item)\n"
|
||||
"{\n"
|
||||
"${nameSet}"
|
||||
"}\n"
|
||||
|
Loading…
Reference in New Issue
Block a user