Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-27 14:52:16 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1907230: Fix error handling in xpc::CreateSandboxObject r=mccr8

Browse Source 
Differential Revision: https://phabricator.services.mozilla.com/D216599
This commit is contained in:
Iain Ireland 2024-07-16 00:08:14 +00:00
parent 96ed4f4df5
commit 81ba3cfa91
4 changed files with 16 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
js/xpconnect/crashtests/1907230.html Normal file
View File

@ -0,0 +1,8 @@
<!DOCTYPE html>
<script>
window.addEventListener("load", () => {
let a = new UIEvent("load", {"bubbles": true})
try { document.doctype.dispatchEvent(a) } catch (e) {}
document.write("<audio>")
})
</script>

1
js/xpconnect/crashtests/crashtests.list
View File

@ -53,3 +53,4 @@ pref(dom.use_xbl_scopes_for_remote_xul,true) load 898939.html
pref(security.fileuri.strict_origin_policy,false) load 938297.html
load 977538.html
load 1577573.html
load 1907230.html

5
js/xpconnect/src/Sandbox.cpp
View File

@ -1500,7 +1500,10 @@ nsresult xpc::CreateSandboxObject(JSContext* cx, MutableHandleValue vp,
// about:memory may use that information
xpc::SetLocationForGlobal(sandbox, options.sandboxName);
xpc::SetSandboxMetadata(cx, sandbox, options.metadata);
nsresult rv = xpc::SetSandboxMetadata(cx, sandbox, options.metadata);
if (NS_WARN_IF(NS_FAILED(rv))) {
return rv;
}
JSAutoRealm ar(cx, sandbox);
JS_FireOnNewGlobalObject(cx, sandbox);

5
js/xpconnect/src/xpcprivate.h
View File

@ -2442,8 +2442,9 @@ nsresult EvalInSandbox(JSContext* cx, JS::HandleObject sandbox,
nsresult GetSandboxMetadata(JSContext* cx, JS::HandleObject sandboxArg,
JS::MutableHandleValue rval);
nsresult SetSandboxMetadata(JSContext* cx, JS::HandleObject sandboxArg,
JS::HandleValue metadata);
[[nodiscard]] nsresult SetSandboxMetadata(JSContext* cx,
JS::HandleObject sandboxArg,
JS::HandleValue metadata);
bool CreateObjectIn(JSContext* cx, JS::HandleValue vobj,
CreateObjectInOptions& options,