wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Fix for bug 769464 (Check mDOMObjectIsISupports when unwrapping). r=bz.

Browse Source 
--HG--
extra : rebase_source : 26d0508b8a11d75164ae4b27af8c64e8845166f9
This commit is contained in:
Peter Van der Beken 2012-07-16 16:52:59 +02:00
parent 039207d5ae
commit e2daa1df74
4 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
dom/bindings/crashtests/769464.html Normal file
View File

@ -0,0 +1,11 @@
<!DOCTYPE html>
<script>
function boom()
{
window.getComputedStyle(new Worker("404.js"));
}
window.addEventListener("load", boom, false);
</script>

1
dom/bindings/crashtests/crashtests.list Normal file
View File

@ -0,0 +1 @@
asserts-if(cocoaWidget,0-1) load 769464.html

5
js/xpconnect/src/XPCQuickStubs.cpp
View File

@ -752,6 +752,11 @@ castNative(JSContext *cx,
QITableEntry *entries;
js::Class* clasp = js::GetObjectClass(cur);
if (dom::IsDOMClass(clasp)) {
dom::DOMJSClass* domClass = dom::DOMJSClass::FromJSClass(clasp);
if (!domClass->mDOMObjectIsISupports) {
*pThisRef = nsnull;
return NS_ERROR_ILLEGAL_VALUE;
}
native = dom::UnwrapDOMObject<nsISupports>(cur);
entries = nsnull;
} else if (dom::binding::instanceIsProxy(cur)) {

1
testing/crashtest/crashtests.list
View File

@ -23,6 +23,7 @@ include ../../content/media/test/crashtests/crashtests.list
include ../../docshell/base/crashtests/crashtests.list
include ../../dom/base/crashtests/crashtests.list
include ../../dom/bindings/crashtests/crashtests.list
include ../../dom/indexedDB/crashtests/crashtests.list
include ../../dom/src/offline/crashtests/crashtests.list
include ../../dom/src/jsurl/crashtests/crashtests.list