Bug 933219 - Fix compartment mismatch in MobileMessageManager::Delete. r=gwagner

This commit is contained in:
Blake Kaplan 2013-12-05 13:28:41 -08:00
parent 6ee70a7c81
commit 54c1a6c666
3 changed files with 18 additions and 20 deletions

View File

@ -11,7 +11,7 @@ interface nsIDOMDOMCursor;
interface nsIDOMDOMRequest;
interface nsIDOMBlob;
[scriptable, builtinclass, uuid(a99c3538-a8d6-492f-9ece-f6e92f9c00c5)]
[scriptable, builtinclass, uuid(8ec8247d-3f5f-41af-9c72-9dc857e3be81)]
interface nsIDOMMozMobileMessageManager : nsIDOMEventTarget
{
nsIDOMDOMRequest getSegmentInfoForText(in DOMString text);
@ -52,6 +52,7 @@ interface nsIDOMMozMobileMessageManager : nsIDOMEventTarget
nsIDOMDOMRequest getMessage(in long id);
// The parameter can be either a message id or a nsIDOMMoz{Mms,Sms}Message.
[implicit_jscontext]
nsIDOMDOMRequest delete(in jsval param);
// Iterates through nsIDOMMoz{Mms,Sms}Message.

View File

@ -304,37 +304,34 @@ MobileMessageManager::GetMessageMoz(int32_t aId, nsIDOMDOMRequest** aRequest)
}
nsresult
MobileMessageManager::GetMessageId(AutoPushJSContext &aCx,
const JS::Value &aMessage, int32_t &aId)
MobileMessageManager::GetMessageId(JSContext* aCx,
const JS::Value& aMessage, int32_t* aId)
{
nsCOMPtr<nsIDOMMozSmsMessage> smsMessage =
do_QueryInterface(nsContentUtils::XPConnect()->GetNativeOfWrapper(aCx, &aMessage.toObject()));
if (smsMessage) {
return smsMessage->GetId(&aId);
return smsMessage->GetId(aId);
}
nsCOMPtr<nsIDOMMozMmsMessage> mmsMessage =
do_QueryInterface(nsContentUtils::XPConnect()->GetNativeOfWrapper(aCx, &aMessage.toObject()));
if (mmsMessage) {
return mmsMessage->GetId(&aId);
return mmsMessage->GetId(aId);
}
return NS_ERROR_INVALID_ARG;
}
NS_IMETHODIMP
MobileMessageManager::Delete(const JS::Value& aParam, nsIDOMDOMRequest** aRequest)
MobileMessageManager::Delete(const JS::Value& aParam, JSContext* aCx,
nsIDOMDOMRequest** aRequest)
{
// We expect Int32, SmsMessage, MmsMessage, Int32[], SmsMessage[], MmsMessage[]
if (!aParam.isObject() && !aParam.isInt32()) {
return NS_ERROR_INVALID_ARG;
}
nsresult rv;
nsIScriptContext* sc = GetContextForEventHandlers(&rv);
AutoPushJSContext cx(sc->GetNativeContext());
NS_ENSURE_STATE(sc);
nsresult rv = NS_OK;
int32_t id, *idArray;
uint32_t size;
@ -344,30 +341,30 @@ MobileMessageManager::Delete(const JS::Value& aParam, nsIDOMDOMRequest** aReques
size = 1;
idArray = &id;
} else if (!JS_IsArrayObject(cx, &aParam.toObject())) {
} else if (!JS_IsArrayObject(aCx, &aParam.toObject())) {
// Single SmsMessage/MmsMessage object
rv = GetMessageId(cx, aParam, id);
rv = GetMessageId(aCx, aParam, &id);
NS_ENSURE_SUCCESS(rv, rv);
size = 1;
idArray = &id;
} else {
// Int32[], SmsMessage[], or MmsMessage[]
JS::Rooted<JSObject*> ids(cx, &aParam.toObject());
JS::Rooted<JSObject*> ids(aCx, &aParam.toObject());
JS_ALWAYS_TRUE(JS_GetArrayLength(cx, ids, &size));
JS_ALWAYS_TRUE(JS_GetArrayLength(aCx, ids, &size));
nsAutoArrayPtr<int32_t> idAutoArray(new int32_t[size]);
JS::Rooted<JS::Value> idJsValue(cx);
JS::Rooted<JS::Value> idJsValue(aCx);
for (uint32_t i = 0; i < size; i++) {
if (!JS_GetElement(cx, ids, i, &idJsValue)) {
if (!JS_GetElement(aCx, ids, i, &idJsValue)) {
return NS_ERROR_INVALID_ARG;
}
if (idJsValue.isInt32()) {
idAutoArray[i] = idJsValue.toInt32();
} else if (idJsValue.isObject()) {
rv = GetMessageId(cx, idJsValue, id);
rv = GetMessageId(aCx, idJsValue, &id);
NS_ENSURE_SUCCESS(rv, rv);
idAutoArray[i] = id;

View File

@ -47,8 +47,8 @@ private:
/**
* Helper to get message ID from SMS/MMS Message object
*/
nsresult GetMessageId(AutoPushJSContext &aCx, const JS::Value &aMessage,
int32_t &aId);
nsresult GetMessageId(JSContext* aCx, const JS::Value& aMessage,
int32_t* aId);
};
} // namespace dom