Bug 697643 - Crash [@ JS_IsExceptionPending] modifying a live NodeList. r=bz.

--HG--
extra : rebase_source : 1d2e5e17c76a04a88468d976e89576d127e4e54f
This commit is contained in:
Peter Van der Beken 2011-10-27 19:39:03 +02:00
parent f4c64c3c0e
commit 451166e8e7
5 changed files with 17 additions and 10 deletions

View File

@ -0,0 +1,5 @@
<script>
document.createElementNS('http://www.w3.org/1999/xhtml', 'select').options[0] = {};
</script>

View File

@ -30,3 +30,4 @@ load 637116.html
load 666869.html
load 675621-1.html
load 693894.html
load 697643.html

View File

@ -313,7 +313,7 @@ ListBase<LC>::getItemAt(ListType *list, uint32 i, IndexGetterType &item)
template<class LC>
bool
ListBase<LC>::setItemAt(ListType *list, uint32 i, IndexSetterType item)
ListBase<LC>::setItemAt(JSContext *cx, ListType *list, uint32 i, IndexSetterType item)
{
JS_STATIC_ASSERT(!hasIndexSetter);
return false;
@ -329,7 +329,8 @@ ListBase<LC>::getNamedItem(ListType *list, const nsAString& aName, NameGetterTyp
template<class LC>
bool
ListBase<LC>::setNamedItem(ListType *list, const nsAString& aName, NameSetterType item)
ListBase<LC>::setNamedItem(JSContext *cx, ListType *list, const nsAString& aName,
NameSetterType item)
{
JS_STATIC_ASSERT(!hasNameSetter);
return false;
@ -687,7 +688,7 @@ ListBase<LC>::defineProperty(JSContext *cx, JSObject *proxy, jsid id, PropertyDe
IndexSetterType value;
jsval v;
return Unwrap(cx, desc->value, &value, getter_AddRefs(ref), &v) &&
setItemAt(getListObject(proxy), index, value);
setItemAt(cx, getListObject(proxy), index, value);
}
}
@ -704,8 +705,7 @@ ListBase<LC>::defineProperty(JSContext *cx, JSObject *proxy, jsid id, PropertyDe
jsval v;
if (!Unwrap(cx, desc->value, &value, getter_AddRefs(ref), &v))
return false;
if (setNamedItem(getListObject(proxy), nameString, value))
return true;
return setNamedItem(cx, getListObject(proxy), nameString, value);
}
if (xpc::WrapperFactory::IsXrayWrapper(proxy))

View File

@ -193,13 +193,14 @@ private:
static JSBool length_getter(JSContext *cx, JSObject *obj, jsid id, jsval *vp);
static inline bool getItemAt(ListType *list, uint32 i, IndexGetterType &item);
static inline bool setItemAt(ListType *list, uint32 i, IndexSetterType item);
static inline bool setItemAt(JSContext *cx, ListType *list, uint32 i, IndexSetterType item);
static inline bool namedItem(JSContext *cx, JSObject *obj, jsval *name, NameGetterType &result,
bool *hasResult);
static inline bool getNamedItem(ListType *list, const nsAString& aName, NameGetterType &item);
static inline bool setNamedItem(ListType *list, const nsAString& aName, NameSetterType item);
static inline bool setNamedItem(JSContext *cx, ListType *list, const nsAString& aName,
NameSetterType item);
static bool getPropertyOnPrototype(JSContext *cx, JSObject *proxy, jsid id, bool *found,
js::Value *vp);

View File

@ -141,7 +141,7 @@ class DOMClass(UserDict.DictMixin):
template = (" !; // TODO")
else:
template = (" nsresult rv = list->%s(index, item);\n"
" return NS_SUCCEEDED(rv) ? true : Throw(nsnull, rv);\n")
" return NS_SUCCEEDED(rv) ? true : Throw(cx, rv);\n")
return template % header.methodNativeName(setter)
@ -503,7 +503,7 @@ indexGetterTemplate = (
indexSetterTemplate = (
"template<>\n"
"bool\n"
"${name}Wrapper::setItemAt(${nativeClass} *list, uint32 index, ${indexSetterType} item)\n"
"${name}Wrapper::setItemAt(JSContext *cx, ${nativeClass} *list, uint32 index, ${indexSetterType} item)\n"
"{\n"
"${indexSet}"
"}\n"
@ -521,7 +521,7 @@ nameGetterTemplate = (
nameSetterTemplate = (
"template<>\n"
"bool\n"
"${name}Wrapper::setNamedItem(${nativeClass} *list, const nsAString& index, ${nameSetterType} item)\n"
"${name}Wrapper::setNamedItem(JSContext *cx, ${nativeClass} *list, const nsAString& index, ${nameSetterType} item)\n"
"{\n"
"${nameSet}"
"}\n"