Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-12-28 03:18:41 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix for bug 769464 (Check mDOMObjectIsISupports when unwrapping). r=bz.

Browse Source 
--HG--
extra : rebase_source : 1bdf15c06e0e1e89a877a0f74300bf212de5b60e
This commit is contained in:
Peter Van der Beken 2012-07-16 16:52:59 +02:00
parent 8d3d9a8f02
commit be3cedb1a9
4 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
dom/bindings/crashtests/769464.html Normal file
View File

@ -0,0 +1,11 @@
<!DOCTYPE html>
<script>
function boom()
{
window.getComputedStyle(new Worker("404.js"));
}
window.addEventListener("load", boom, false);
</script>

1
dom/bindings/crashtests/crashtests.list Normal file
View File

@ -0,0 +1 @@
load 769464.html

5
js/xpconnect/src/XPCQuickStubs.cpp
View File

@ -752,6 +752,11 @@ castNative(JSContext *cx,
QITableEntry *entries;
js::Class* clasp = js::GetObjectClass(cur);
if (dom::IsDOMClass(clasp)) {
dom::DOMJSClass* domClass = dom::DOMJSClass::FromJSClass(clasp);
if (!domClass->mDOMObjectIsISupports) {
*pThisRef = nsnull;
return NS_ERROR_ILLEGAL_VALUE;
}
native = dom::UnwrapDOMObject<nsISupports>(cur);
entries = nsnull;
} else if (dom::binding::instanceIsProxy(cur)) {

1
testing/crashtest/crashtests.list
View File

@ -23,6 +23,7 @@ include ../../content/media/test/crashtests/crashtests.list
include ../../docshell/base/crashtests/crashtests.list
include ../../dom/base/crashtests/crashtests.list
include ../../dom/bindings/crashtests/crashtests.list
include ../../dom/indexedDB/crashtests/crashtests.list
include ../../dom/src/offline/crashtests/crashtests.list
include ../../dom/src/jsurl/crashtests/crashtests.list