wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 604807 - Make nsISelectElement unscriptable to prevent crashes; r=bz a=blocking-beta9

Browse Source 
--HG--
extra : rebase_source : 39c142478f0dea004e32b023b7253b244fe0f14a
This commit is contained in:
Ms2ger 2010-12-17 18:10:51 -08:00
parent a7f188e73e
commit 2104b9efeb
3 changed files with 18 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
content/html/content/crashtests/604807.html Normal file
View File

@ -0,0 +1,9 @@
<!DOCTYPE html>
<script>
try {
var selectElem = document.createElementNS("http://www.w3.org/1999/xhtml", "select");
selectElem.QueryInterface(Components.interfaces.nsISelectElement);
selectElem.getOptionIndex(null, 0, true);
} catch (e) {
}
</script>

1
content/html/content/crashtests/crashtests.list
View File

@ -20,6 +20,7 @@ load 580507-1.xhtml
load 590387.html
load 596785-1.html
load 596785-2.html
load 604807.html
load 606430-1.html
load 602117.html
load 613027.html

16
content/html/content/public/nsISelectElement.idl
View File

@ -48,7 +48,7 @@ interface nsIDOMHTMLOptionElement;
* OPTIONs within a SELECT element.
*/
[scriptable, uuid(aa73a61a-8ef2-402d-b86c-3a5c5f2a6027)]
[noscript, uuid(aa73a61a-8ef2-402d-b86c-3a5c5f2a6027)]
interface nsISelectElement : nsISupports
{
@ -62,10 +62,10 @@ interface nsISelectElement : nsISupports
* @param aContentIndex the index where the options are being added within the
* parent (if the parent is an optgroup, the index within the optgroup)
*/
[noscript] void willAddOptions(in nsIContent aOptions,
in nsIContent aParent,
in long aContentIndex,
in boolean aNotify);
void willAddOptions(in nsIContent aOptions,
in nsIContent aParent,
in long aContentIndex,
in boolean aNotify);
/**
* To be called when stuff is removed under a child of the select--but
@ -75,9 +75,9 @@ interface nsISelectElement : nsISupports
* @param aContentIndex the index of the option(s) within the parent (if the
* parent is an optgroup, the index within the optgroup)
*/
[noscript] void willRemoveOptions(in nsIContent aParent,
in long aContentIndex,
in boolean aNotify);
void willRemoveOptions(in nsIContent aParent,
in long aContentIndex,
in boolean aNotify);
/**
* Checks whether an option is disabled (even if it's part of an optgroup)