Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-17 23:35:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1505059 - Compartment fixes for two JSAPI functions. r=tcampbell

Browse Source 
Differential Revision: https://phabricator.services.mozilla.com/D11089

--HG--
extra : moz-landing-system : lando
This commit is contained in:
Till Schneidereit 2018-11-06 19:58:42 +00:00
parent 4d9ee13f3e
commit 9cae2bda28
2 changed files with 23 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
js/src/vm/ArrayBufferObject.cpp
View File

@ -1847,6 +1847,7 @@ JS_StealArrayBufferContents(JSContext* cx, HandleObject objArg)
JSObject* obj = CheckedUnwrap(objArg);
if (!obj) {
ReportAccessDenied(cx);
return nullptr;
}

29
js/src/vm/ArrayBufferViewObject.cpp
View File

@ -215,19 +215,34 @@ JS_GetArrayBufferViewData(JSObject* obj, bool* isSharedMemory, const JS::AutoReq
}
JS_FRIEND_API(JSObject*)
JS_GetArrayBufferViewBuffer(JSContext* cx, HandleObject objArg, bool* isSharedMemory)
JS_GetArrayBufferViewBuffer(JSContext* cx, HandleObject obj, bool* isSharedMemory)
{
AssertHeapIsIdle();
CHECK_THREAD(cx);
cx->check(objArg);
cx->check(obj);
JSObject* obj = CheckedUnwrap(objArg);
if (!obj) {
JSObject* unwrappedObj = CheckedUnwrap(obj);
if (!unwrappedObj) {
ReportAccessDenied(cx);
return nullptr;
}
Rooted<ArrayBufferViewObject*> viewObject(cx, &obj->as<ArrayBufferViewObject>());
ArrayBufferObjectMaybeShared* buffer = ArrayBufferViewObject::bufferObject(cx, viewObject);
*isSharedMemory = buffer->is<SharedArrayBufferObject>();
Rooted<ArrayBufferViewObject*> unwrappedView(cx, &unwrappedObj->as<ArrayBufferViewObject>());
ArrayBufferObjectMaybeShared* unwrappedBuffer;
{
AutoRealm ar(cx, unwrappedObj);
unwrappedBuffer = ArrayBufferViewObject::bufferObject(cx, unwrappedView);
if (!unwrappedBuffer) {
return nullptr;
}
}
*isSharedMemory = unwrappedBuffer->is<SharedArrayBufferObject>();
RootedObject buffer(cx, unwrappedBuffer);
if (!cx->compartment()->wrap(cx, &buffer)) {
return nullptr;
}
return buffer;
}