wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 648206 - Deal with JS engine annoyances. r=gal

Browse Source 
--HG--
extra : rebase_source : dcb0f814a0bf7d3965404744498220fb8eb3da8c
This commit is contained in:
Blake Kaplan 2011-04-11 16:04:47 -07:00
parent ef3612d1d3
commit 10a1ebb2d2
3 changed files with 24 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
js/src/xpconnect/crashtests/648206-1.html Normal file
View File

@ -0,0 +1,7 @@
<!DOCTYPE html>
<script>
InstallTrigger.__proto__ = window.getComputedStyle(document.documentElement);
InstallTrigger[0] = 0;
</script>

1
js/src/xpconnect/crashtests/crashtests.list
View File

@ -30,3 +30,4 @@ load 582649.html
load 603858-1.html
load 608963.html
load 639737-1.html
load 648206-1.html

18
js/src/xpconnect/wrappers/XrayWrapper.cpp
View File

@ -175,13 +175,26 @@ EnsureExpandoObject(JSContext *cx, JSObject *holder)
return expando;
}
static inline JSObject *
FindWrapper(JSObject *wrapper)
{
while (!wrapper->isWrapper() ||
!(JSWrapper::wrapperHandler(wrapper)->flags() & WrapperFactory::IS_XRAY_WRAPPER_FLAG)) {
wrapper = wrapper->getProto();
// NB: we must eventually hit our wrapper.
}
return wrapper;
}
// Some DOM objects have shared properties that don't have an explicit
// getter/setter and rely on the class getter/setter. We install a
// class getter/setter on the holder object to trigger them.
static JSBool
holder_get(JSContext *cx, JSObject *wrapper, jsid id, jsval *vp)
{
NS_ASSERTION(wrapper->isProxy(), "bad this object in get");
wrapper = FindWrapper(wrapper);
JSObject *holder = GetHolder(wrapper);
JSObject *wnObject = GetWrappedNativeObjectFromHolder(cx, holder);
@ -204,7 +217,8 @@ holder_get(JSContext *cx, JSObject *wrapper, jsid id, jsval *vp)
static JSBool
holder_set(JSContext *cx, JSObject *wrapper, jsid id, JSBool strict, jsval *vp)
{
NS_ASSERTION(wrapper->isProxy(), "bad this object in set");
wrapper = FindWrapper(wrapper);
JSObject *holder = GetHolder(wrapper);
if (IsResolving(holder, id)) {
return true;