Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-22 09:45:41 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1525905 - Require both arguments to JS_TransplantObject to be non-gray r=sfink r=bz

Browse Source
This commit is contained in:
Jon Coppeard 2019-02-09 07:30:08 +00:00
parent 94e9660ff4
commit e3e3e6ab9a
2 changed files with 4 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
dom/base/nsGlobalWindowOuter.cpp
View File

@ -2080,7 +2080,7 @@ nsresult nsGlobalWindowOuter::SetNewDocument(Document* aDocument,
return NS_ERROR_FAILURE;
}
JS::Rooted<JSObject*> obj(cx, GetWrapperPreserveColor());
JS::Rooted<JSObject*> obj(cx, GetWrapper());
MOZ_ASSERT(js::IsWindowProxy(obj));

9
js/src/jsapi.cpp
View File

@ -685,6 +685,7 @@ JS_PUBLIC_API JSObject* JS_TransplantObject(JSContext* cx, HandleObject origobj,
MOZ_ASSERT(!target->is<CrossCompartmentWrapperObject>());
MOZ_ASSERT(origobj->getClass() == target->getClass());
ReleaseAssertObjectHasNoWrappers(cx, target);
JS::AssertCellIsNotGray(origobj);
JS::AssertCellIsNotGray(target);
RootedValue origv(cx, ObjectValue(*origobj));
@ -702,13 +703,9 @@ JS_PUBLIC_API JSObject* JS_TransplantObject(JSContext* cx, HandleObject origobj,
// destination, then we know that we won't find a wrapper in the
// destination's cross compartment map and that the same
// object will continue to work.
AutoRealmUnchecked ar(cx, origobj->nonCCWRealm());
AutoRealm ar(cx, origobj);
JSObject::swap(cx, origobj, target);
newIdentity = origobj;
// |origobj| might be gray so unmark it to avoid returning a possibly-gray
// object.
JS::ExposeObjectToActiveJS(newIdentity);
} else if (WrapperMap::Ptr p = destination->lookupWrapper(origv)) {
// There might already be a wrapper for the original object in
// the new compartment. If there is, we use its identity and swap
@ -739,7 +736,7 @@ JS_PUBLIC_API JSObject* JS_TransplantObject(JSContext* cx, HandleObject origobj,
// Lastly, update the original object to point to the new one.
if (origobj->compartment() != destination) {
RootedObject newIdentityWrapper(cx, newIdentity);
AutoRealmUnchecked ar(cx, origobj->nonCCWRealm());
AutoRealm ar(cx, origobj);
if (!JS_WrapObject(cx, &newIdentityWrapper)) {
MOZ_CRASH();
}