wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 684544. Restore missing null-check for location setter. r=mrbkap

Browse Source
This commit is contained in:
Boris Zbarsky 2011-09-06 22:57:46 -04:00
parent a5697731ec
commit 75baef868d
3 changed files with 67 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
dom/base/nsDOMClassInfo.cpp
View File

@ -6378,19 +6378,30 @@ LocationSetterGuts(JSContext *cx, JSObject *obj, jsval *vp)
nsresult rv = xpcomObj->GetLocation(getter_AddRefs(location));
NS_ENSURE_SUCCESS(rv, rv);
// Grab the value we're being set to before we stomp on |vp|
JSString *val = ::JS_ValueToString(cx, *vp);
NS_ENSURE_TRUE(val, NS_ERROR_UNEXPECTED);
// Make sure |val| stays alive below
JS::Anchor<JSString *> anchor(val);
// We have to wrap location into vp before null-checking location, to
// avoid assigning the wrong thing into the slot.
nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
rv = WrapNative(cx, JS_GetGlobalForScopeChain(cx), location,
&NS_GET_IID(nsIDOMLocation), PR_TRUE, vp,
getter_AddRefs(holder));
NS_ENSURE_SUCCESS(rv, rv);
if (!location) {
// Make this a no-op
return NS_OK;
}
nsDependentJSString depStr;
NS_ENSURE_TRUE(depStr.init(cx, val), NS_ERROR_UNEXPECTED);
rv = location->SetHref(depStr);
NS_ENSURE_SUCCESS(rv, rv);
nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
return WrapNative(cx, JS_GetGlobalForScopeChain(cx), location,
&NS_GET_IID(nsIDOMLocation), PR_TRUE, vp,
getter_AddRefs(holder));
return location->SetHref(depStr);
}
template<class Interface>

1
dom/tests/mochitest/bugs/Makefile.in
View File

@ -140,6 +140,7 @@ _TEST_FILES = \
test_bug642026.html \
test_bug648465.html \
test_bug654137.html \
test_bug684544.html \
test_window_bar.html \
file_window_bar.html \
test_resize_move_windows.html \

48
dom/tests/mochitest/bugs/test_bug684544.html Normal file
View File

@ -0,0 +1,48 @@
<!DOCTYPE HTML>
<html>
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=
-->
<head>
<title>Test for Bug </title>
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
</head>
<body>
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=">Mozilla Bug </a>
<p id="display"></p>
<div id="content" style="display: none">
</div>
<pre id="test">
<script type="application/javascript">
/** Test for Bug **/
var f = document.createElement("iframe");
document.body.appendChild(f);
var win = f.contentWindow;
// Set location once to make sure it's resolved
win.location = "data:text/html,1";
// Now try to make the location object go away.
f.parentNode.removeChild(f);
// Check that location is now null. If it's not, the test needs changing
// (e.g. to use window.close() so that it's null).
is("location" in win, true, "Should still have a location property");
todo_is(win.location, null, "There should be no location object now");
// Just set the location. This should not crash.
win.location = "data:text/html,2";
// And check that we didn't override the slot in the process.
is(typeof(win.location), "object", "Location should not have become a string");
is(win.location, null,
"There should be no location object for real after the set");
</script>
</pre>
</body>
</html>