wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Backed out 6 changesets (bug 1088228) for static analysis bustage

Browse Source 
Backed out changeset 13ecff800114 (bug 1088228)
Backed out changeset de692c3335f2 (bug 1088228)
Backed out changeset 2d449a2b4e1c (bug 1088228)
Backed out changeset 49ac8f33ab70 (bug 1088228)
Backed out changeset 920d50e84a17 (bug 1088228)
Backed out changeset 55f4818378e4 (bug 1088228)
This commit is contained in:
Wes Kocher 2014-10-30 16:24:02 -07:00
parent d3ab192815
commit f060936900
19 changed files with 116 additions and 149 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
dom/base/Element.cpp
View File

@ -500,13 +500,6 @@ Element::WrapObject(JSContext *aCx)
return obj;
}
/* virtual */
nsINode*
Element::GetScopeChainParent() const
{
return OwnerDoc();
}
nsDOMTokenList*
Element::ClassList()
{

6
dom/base/Element.h
View File

@ -139,8 +139,8 @@ class DestinationInsertionPointList;
// IID for the dom::Element interface
#define NS_ELEMENT_IID \
{ 0x31d3f3fb, 0xcdf8, 0x4e40, \
{ 0xb7, 0x09, 0x1a, 0x11, 0x43, 0x93, 0x61, 0x71 } }
{ 0xaa79cb98, 0xc785, 0x44c5, \
{ 0x80, 0x80, 0x2e, 0x5f, 0x0c, 0xa5, 0xbd, 0x63 } }
class Element : public FragmentOrElement
{
@ -961,8 +961,6 @@ public:
virtual JSObject* WrapObject(JSContext *aCx) MOZ_FINAL MOZ_OVERRIDE;
nsINode* GetScopeChainParent() const MOZ_OVERRIDE;
/**
* Locate an nsIEditor rooted at this content node, if there is one.
*/

10
dom/base/nsIDocument.h
View File

@ -136,8 +136,8 @@ typedef CallbackObjectHolder<NodeFilter, nsIDOMNodeFilter> NodeFilterHolder;
} // namespace mozilla
#define NS_IDOCUMENT_IID \
{ 0x6bbf1955, 0xd9c4, 0x4d61, \
{ 0xbf, 0x75, 0x1b, 0xba, 0x55, 0xf7, 0x99, 0xc2 } }
{ 0xbab5b447, 0x7e23, 0x4cdd, \
{ 0xac, 0xe5, 0xaa, 0x04, 0x26, 0x87, 0x2b, 0x97 } }
// Enum for requesting a particular type of document when creating a doc
enum DocumentFlavor {
@ -2877,11 +2877,7 @@ nsINode::OwnerDocAsNode() const
inline mozilla::dom::ParentObject
nsINode::GetParentObject() const
{
mozilla::dom::ParentObject p(OwnerDoc());
// Note that mUseXBLScope is a no-op for chrome, and other places where we
// don't use XBL scopes.
p.mUseXBLScope = IsInAnonymousSubtree() && !IsAnonymousContentInSVGUseSubtree();
return p;
return GetParentObjectInternal(OwnerDoc());
}
#endif /* nsIDocument_h___ */

5
dom/base/nsINode.cpp
View File

@ -2752,8 +2752,3 @@ nsINode::HasBoxQuadsSupport(JSContext* aCx, JSObject* /* unused */)
Preferences::GetBool("layout.css.getBoxQuads.enabled");
}
nsINode*
nsINode::GetScopeChainParent() const
{
return nullptr;
}

22
dom/base/nsINode.h
View File

@ -248,8 +248,8 @@ private:
// IID for the nsINode interface
#define NS_INODE_IID \
{ 0x66972940, 0x1d1b, 0x4d15, \
{ 0x93, 0x11, 0x96, 0x72, 0x84, 0x2e, 0xc7, 0x27 } }
{ 0x8deda3f4, 0x0f45, 0x497a, \
{ 0x89, 0x7c, 0xe6, 0x09, 0x12, 0x8a, 0xad, 0xd8 } }
/**
* An internal interface that abstracts some DOMNode-related parts that both
@ -382,16 +382,20 @@ protected:
*/
virtual JSObject* WrapNode(JSContext *aCx) = 0;
// Subclasses that wish to override the parent behavior should return the
// result of GetParentObjectIntenral, which handles the XBL scope stuff.
//
mozilla::dom::ParentObject GetParentObjectInternal(nsINode* aNativeParent) const {
mozilla::dom::ParentObject p(aNativeParent);
// Note that mUseXBLScope is a no-op for chrome, and other places where we
// don't use XBL scopes.
p.mUseXBLScope = IsInAnonymousSubtree() && !IsAnonymousContentInSVGUseSubtree();
return p;
}
public:
mozilla::dom::ParentObject GetParentObject() const; // Implemented in nsIDocument.h
/**
* Return the scope chain parent for this node, for use in things
* like event handler compilation. Returning null means to use the
* global object as the scope chain parent.
*/
virtual nsINode* GetScopeChainParent() const;
/**
* Return whether the node is an Element node
*/

23
dom/base/nsJSUtils.cpp
View File

@ -27,8 +27,6 @@
#include "nsContentUtils.h"
#include "nsGlobalWindow.h"
#include "mozilla/dom/BindingUtils.h"
#include "mozilla/dom/Element.h"
#include "mozilla/dom/ScriptSettings.h"
using namespace mozilla::dom;
@ -315,27 +313,6 @@ nsJSUtils::EvaluateString(JSContext* aCx,
options, &unused, aOffThreadToken);
}
/* static */
bool
nsJSUtils::GetScopeChainForElement(JSContext* aCx,
mozilla::dom::Element* aElement,
JS::AutoObjectVector& aScopeChain)
{
for (nsINode* cur = aElement; cur; cur = cur->GetScopeChainParent()) {
JS::RootedValue val(aCx);
if (!WrapNewBindingObject(aCx, cur, &val)) {
return false;
}
if (!aScopeChain.append(&val.toObject())) {
return false;
}
}
return true;
}
//
// nsDOMJSUtils.h
//

6
dom/base/nsJSUtils.h
View File

@ -25,7 +25,6 @@ class nsIScriptGlobalObject;
namespace mozilla {
namespace dom {
class AutoJSAPI;
class Element;
}
}
@ -120,11 +119,6 @@ public:
JS::CompileOptions &aCompileOptions,
void **aOffThreadToken = nullptr);
// Returns false if an exception got thrown on aCx. Passing a null
// aElement is allowed; that wil produce an empty aScopeChain.
static bool GetScopeChainForElement(JSContext* aCx,
mozilla::dom::Element* aElement,
JS::AutoObjectVector& aScopeChain);
};
class MOZ_STACK_CLASS AutoDontReportUncaught {

21
dom/bindings/BindingUtils.h
View File

@ -1504,6 +1504,22 @@ WrapNativeParent(JSContext* cx, const T& p)
return WrapNativeParent(cx, GetParentPointer(p), GetWrapperCache(p), GetUseXBLScope(p));
}
// A way to differentiate between nodes, which use the parent object
// returned by native->GetParentObject(), and all other objects, which
// just use the parent's global.
static inline JSObject*
GetRealParentObject(void* aParent, JSObject* aParentObject)
{
return aParentObject ?
js::GetGlobalForObjectCrossCompartment(aParentObject) : nullptr;
}
static inline JSObject*
GetRealParentObject(Element* aParent, JSObject* aParentObject)
{
return aParentObject;
}
HAS_MEMBER(GetParentObject)
template<typename T, bool WrapperCached=HasGetParentObjectMember<T>::Value>
@ -1513,8 +1529,9 @@ struct GetParentObject
{
MOZ_ASSERT(js::IsObjectInContextCompartment(obj, cx));
T* native = UnwrapDOMObject<T>(obj);
JSObject* wrappedParent = WrapNativeParent(cx, native->GetParentObject());
return wrappedParent ? js::GetGlobalForObjectCrossCompartment(wrappedParent) : nullptr;
return
GetRealParentObject(native,
WrapNativeParent(cx, native->GetParentObject()));
}
};

32
dom/bindings/Codegen.py
View File

@ -3069,23 +3069,24 @@ class CGConstructorEnabled(CGAbstractMethod):
return body.define()
def CreateBindingJSObject(descriptor, properties):
def CreateBindingJSObject(descriptor, properties, parent):
# We don't always need to root obj, but there are a variety
# of cases where we do, so for simplicity, just always root it.
objDecl = "JS::Rooted<JSObject*> obj(aCx);\n"
if descriptor.proxy:
create = dedent(
create = fill(
"""
JS::Rooted<JS::Value> proxyPrivateVal(aCx, JS::PrivateValue(aObject));
js::ProxyOptions options;
options.setClass(&Class.mBase);
obj = NewProxyObject(aCx, DOMProxyHandler::getInstance(),
proxyPrivateVal, proto, global, options);
proxyPrivateVal, proto, ${parent}, options);
if (!obj) {
return nullptr;
}
""")
""",
parent=parent)
if descriptor.interface.getExtendedAttribute('OverrideBuiltins'):
create += dedent("""
js::SetProxyExtra(obj, JSPROXYSLOT_EXPANDO,
@ -3093,15 +3094,16 @@ def CreateBindingJSObject(descriptor, properties):
""")
else:
create = dedent(
create = fill(
"""
obj = JS_NewObject(aCx, Class.ToJSClass(), proto, global);
obj = JS_NewObject(aCx, Class.ToJSClass(), proto, ${parent});
if (!obj) {
return nullptr;
}
js::SetReservedSlot(obj, DOM_OBJECT_SLOT, PRIVATE_TO_JSVAL(aObject));
""")
""",
parent=parent)
create = objDecl + create
if descriptor.nativeOwnership == 'refcounted':
@ -3252,7 +3254,9 @@ class CGWrapWithCacheMethod(CGAbstractMethod):
MOZ_ASSERT(ToSupportsIsOnPrimaryInheritanceChain(aObject, aCache),
"nsISupports must be on our primary inheritance chain");
JS::Rooted<JSObject*> parent(aCx, WrapNativeParent(aCx, aObject->GetParentObject()));
JS::Rooted<JSObject*> parent(aCx,
GetRealParentObject(aObject,
WrapNativeParent(aCx, aObject->GetParentObject())));
if (!parent) {
return nullptr;
}
@ -3268,13 +3272,13 @@ class CGWrapWithCacheMethod(CGAbstractMethod):
}
JSAutoCompartment ac(aCx, parent);
JS::Rooted<JSObject*> global(aCx, js::GetGlobalForObjectCrossCompartment(parent));
JS::Rooted<JSObject*> global(aCx, JS_GetGlobalForObject(aCx, parent));
JS::Handle<JSObject*> proto = GetProtoObjectHandle(aCx, global);
if (!proto) {
return nullptr;
}
$*{createObject}
$*{parent}
$*{unforgeable}
@ -3283,7 +3287,8 @@ class CGWrapWithCacheMethod(CGAbstractMethod):
return obj;
""",
assertion=AssertInheritanceChain(self.descriptor),
createObject=CreateBindingJSObject(self.descriptor, self.properties),
parent=CreateBindingJSObject(self.descriptor, self.properties,
"parent"),
unforgeable=InitUnforgeableProperties(self.descriptor, self.properties),
slots=InitMemberSlots(self.descriptor, True))
@ -3329,7 +3334,7 @@ class CGWrapNonWrapperCacheMethod(CGAbstractMethod):
return nullptr;
}
$*{createObject}
$*{global_}
$*{unforgeable}
@ -3337,7 +3342,8 @@ class CGWrapNonWrapperCacheMethod(CGAbstractMethod):
return obj;
""",
assertions=AssertInheritanceChain(self.descriptor),
createObject=CreateBindingJSObject(self.descriptor, self.properties),
global_=CreateBindingJSObject(self.descriptor, self.properties,
"global"),
unforgeable=InitUnforgeableProperties(self.descriptor, self.properties),
slots=InitMemberSlots(self.descriptor, False))

31
dom/events/EventListenerManager.cpp
View File

@ -863,6 +863,18 @@ EventListenerManager::CompileEventHandlerInternal(Listener* aListener,
}
}
JS::AutoObjectVector scopeChain(cx);
{ // scope for curScope
// We append all the non-globals on our desired scope chain.
JS::Rooted<JSObject*> curScope(cx, &v.toObject());
while (curScope && !JS_IsGlobalObject(curScope)) {
if (!scopeChain.append(curScope)) {
return NS_ERROR_OUT_OF_MEMORY;
}
curScope = JS_GetParent(curScope);
}
}
if (addonId) {
JS::Rooted<JSObject*> vObj(cx, &v.toObject());
JS::Rooted<JSObject*> addonScope(cx, xpc::GetAddonScope(cx, vObj, addonId));
@ -870,9 +882,14 @@ EventListenerManager::CompileEventHandlerInternal(Listener* aListener,
return NS_ERROR_FAILURE;
}
JSAutoCompartment ac(cx, addonScope);
for (size_t i = 0; i < scopeChain.length(); ++i) {
if (!JS_WrapObject(cx, scopeChain[i])) {
return NS_ERROR_FAILURE;
}
}
// Wrap our event target into the addon scope, since that's where we want to
// do all our work.
// And wrap v as well, since scopeChain might be empty so we can't
// reliably use it to enter a compartment.
if (!JS_WrapValue(cx, &v)) {
return NS_ERROR_FAILURE;
}
@ -880,16 +897,6 @@ EventListenerManager::CompileEventHandlerInternal(Listener* aListener,
JS::Rooted<JSObject*> target(cx, &v.toObject());
JSAutoCompartment ac(cx, target);
// Now that we've entered the compartment we actually care about, create our
// scope chain. Note that we start with |element|, not aElement, because
// mTarget is different from aElement in the <body> case, where mTarget is a
// Window, and in that case we do not want the scope chain to include the body
// or the document.
JS::AutoObjectVector scopeChain(cx);
if (!nsJSUtils::GetScopeChainForElement(cx, element, scopeChain)) {
return NS_ERROR_OUT_OF_MEMORY;
}
nsDependentAtomString str(attrName);
// Most of our names are short enough that we don't even have to malloc
// the JS string stuff, so don't worry about playing games with

2
dom/html/HTMLLegendElement.cpp
View File

@ -22,7 +22,7 @@ HTMLLegendElement::~HTMLLegendElement()
NS_IMPL_ELEMENT_CLONE(HTMLLegendElement)
nsIContent*
HTMLLegendElement::GetFieldSet() const
HTMLLegendElement::GetFieldSet()
{
nsIContent* parent = GetParent();

10
dom/html/HTMLLegendElement.h
View File

@ -54,7 +54,7 @@ public:
virtual nsresult Clone(mozilla::dom::NodeInfo* aNodeInfo, nsINode** aResult) const MOZ_OVERRIDE;
Element* GetFormElement() const
Element* GetFormElement()
{
nsCOMPtr<nsIFormControl> fieldsetControl = do_QueryInterface(GetFieldSet());
@ -77,10 +77,10 @@ public:
SetHTMLAttr(nsGkAtoms::align, aAlign, aError);
}
nsINode* GetScopeChainParent() const MOZ_OVERRIDE
{
ParentObject GetParentObject() {
Element* form = GetFormElement();
return form ? form : nsGenericHTMLElement::GetScopeChainParent();
return form ? GetParentObjectInternal(form)
: nsGenericHTMLElement::GetParentObject();
}
protected:
@ -92,7 +92,7 @@ protected:
* Get the fieldset content element that contains this legend.
* Returns null if there is no fieldset containing this legend.
*/
nsIContent* GetFieldSet() const;
nsIContent* GetFieldSet();
};
} // namespace dom

10
dom/html/nsGenericHTMLElement.cpp
View File

@ -1896,10 +1896,14 @@ NS_IMPL_ISUPPORTS_INHERITED(nsGenericHTMLFormElement,
nsGenericHTMLElement,
nsIFormControl)
nsINode*
nsGenericHTMLFormElement::GetScopeChainParent() const
mozilla::dom::ParentObject
nsGenericHTMLFormElement::GetParentObject() const
{
return mForm ? mForm : nsGenericHTMLElement::GetScopeChainParent();
// We use the parent chain to implement the scope for event handlers.
if (mForm) {
return GetParentObjectInternal(mForm);
}
return nsGenericHTMLElement::GetParentObject();
}
bool

2
dom/html/nsGenericHTMLElement.h
View File

@ -1245,7 +1245,7 @@ public:
NS_DECL_ISUPPORTS_INHERITED
nsINode* GetScopeChainParent() const MOZ_OVERRIDE;
mozilla::dom::ParentObject GetParentObject() const;
virtual bool IsNodeOfType(uint32_t aFlags) const MOZ_OVERRIDE;
virtual void SaveSubtreeState() MOZ_OVERRIDE;

24
dom/xbl/nsXBLProtoImplMethod.cpp
View File

@ -269,7 +269,6 @@ nsXBLProtoImplMethod::Write(nsIObjectOutputStream* aStream)
nsresult
nsXBLProtoImplAnonymousMethod::Execute(nsIContent* aBoundElement, JSAddonId* aAddonId)
{
MOZ_ASSERT(aBoundElement->IsElement());
NS_PRECONDITION(IsCompiled(), "Can't execute uncompiled method");
if (!GetCompiledMethod()) {
@ -296,22 +295,23 @@ nsXBLProtoImplAnonymousMethod::Execute(nsIContent* aBoundElement, JSAddonId* aAd
JS::Rooted<JSObject*> globalObject(cx, global->GetGlobalJSObject());
JS::Rooted<JS::Value> v(cx);
nsresult rv = nsContentUtils::WrapNative(cx, aBoundElement, &v);
NS_ENSURE_SUCCESS(rv, rv);
JS::Rooted<JSObject*> thisObject(cx, &v.toObject());
JS::Rooted<JSObject*> scopeObject(cx, xpc::GetScopeForXBLExecution(cx, globalObject, aAddonId));
NS_ENSURE_TRUE(scopeObject, NS_ERROR_OUT_OF_MEMORY);
JSAutoCompartment ac(cx, scopeObject);
JS::AutoObjectVector scopeChain(cx);
if (!nsJSUtils::GetScopeChainForElement(cx, aBoundElement->AsElement(),
scopeChain)) {
return NS_ERROR_OUT_OF_MEMORY;
}
MOZ_ASSERT(scopeChain.length() != 0);
if (!JS_WrapObject(cx, &thisObject))
return NS_ERROR_OUT_OF_MEMORY;
// Clone the function object, using our scope chain (for backwards
// compat to the days when this was an event handler).
// Clone the function object, using thisObject as the parent so "this" is in
// the scope chain of the resulting function (for backwards compat to the
// days when this was an event handler).
JS::Rooted<JSObject*> jsMethodObject(cx, GetCompiledMethod());
JS::Rooted<JSObject*> method(cx, JS::CloneFunctionObject(cx, jsMethodObject,
scopeChain));
JS::Rooted<JSObject*> method(cx, ::JS_CloneFunctionObject(cx, jsMethodObject, thisObject));
if (!method)
return NS_ERROR_OUT_OF_MEMORY;
@ -325,7 +325,7 @@ nsXBLProtoImplAnonymousMethod::Execute(nsIContent* aBoundElement, JSAddonId* aAd
if (scriptAllowed) {
JS::Rooted<JS::Value> retval(cx);
JS::Rooted<JS::Value> methodVal(cx, JS::ObjectValue(*method));
ok = ::JS::Call(cx, scopeChain[0], methodVal, JS::HandleValueArray::empty(), &retval);
ok = ::JS::Call(cx, thisObject, methodVal, JS::HandleValueArray::empty(), &retval);
}
if (!ok) {

18
dom/xbl/nsXBLPrototypeHandler.cpp
View File

@ -44,7 +44,6 @@
#include "mozilla/BasicEvents.h"
#include "mozilla/JSEventHandler.h"
#include "mozilla/Preferences.h"
#include "mozilla/dom/Element.h"
#include "mozilla/dom/EventHandlerBinding.h"
#include "mozilla/dom/ScriptSettings.h"
#include "xpcpublic.h"
@ -301,15 +300,16 @@ nsXBLPrototypeHandler::ExecuteHandler(EventTarget* aTarget,
NS_ENSURE_TRUE(ok, NS_ERROR_OUT_OF_MEMORY);
MOZ_ASSERT(!js::IsCrossCompartmentWrapper(genericHandler));
// Build a scope chain in the XBL scope.
nsRefPtr<Element> targetElement = do_QueryObject(scriptTarget);
JS::AutoObjectVector scopeChain(cx);
ok = nsJSUtils::GetScopeChainForElement(cx, targetElement, scopeChain);
NS_ENSURE_TRUE(ok, NS_ERROR_OUT_OF_MEMORY);
// Wrap the native into the XBL scope. This creates a reflector in the document
// scope if one doesn't already exist, and potentially wraps it cross-
// compartment into our scope (via aAllowWrapping=true).
JS::Rooted<JS::Value> targetV(cx, JS::UndefinedValue());
rv = nsContentUtils::WrapNative(cx, scriptTarget, &targetV);
NS_ENSURE_SUCCESS(rv, rv);
// Next, clone the generic handler with our desired scope chain.
JS::Rooted<JSObject*> bound(cx, JS::CloneFunctionObject(cx, genericHandler,
scopeChain));
// Next, clone the generic handler to be parented to the target.
JS::Rooted<JSObject*> target(cx, &targetV.toObject());
JS::Rooted<JSObject*> bound(cx, JS_CloneFunctionObject(cx, genericHandler, target));
NS_ENSURE_TRUE(bound, NS_ERROR_FAILURE);
nsRefPtr<EventHandlerNonNull> handlerCallback =

9
dom/xul/nsXULElement.h
View File

@ -606,11 +606,14 @@ public:
already_AddRefed<nsFrameLoader> GetFrameLoader();
void SwapFrameLoaders(nsXULElement& aOtherOwner, mozilla::ErrorResult& rv);
nsINode* GetScopeChainParent() const MOZ_OVERRIDE
// For XUL, the parent is the parent element, if any
mozilla::dom::ParentObject GetParentObject() const
{
// For XUL, the parent is the parent element, if any
Element* parent = GetParentElement();
return parent ? parent : nsStyledElement::GetScopeChainParent();
if (parent) {
return GetParentObjectInternal(parent);
}
return nsStyledElement::GetParentObject();
}
protected:

15
js/src/jsapi.cpp
View File

@ -3919,21 +3919,6 @@ JS_CloneFunctionObject(JSContext *cx, HandleObject funobj, HandleObject parentAr
return CloneFunctionObject(cx, fun, parent, fun->getAllocKind());
}
namespace JS {
JS_PUBLIC_API(JSObject *)
CloneFunctionObject(JSContext *cx, HandleObject funobj, AutoObjectVector &scopeChain)
{
RootedObject dynamicScope(cx);
RootedObject unusedStaticScope(cx);
if (!CreateScopeObjectsForScopeChain(cx, scopeChain, &dynamicScope, &unusedStaticScope))
return nullptr;
return JS_CloneFunctionObject(cx, funobj, dynamicScope);
}
} // namespace JS
JS_PUBLIC_API(JSObject *)
JS_GetFunctionObject(JSFunction *fun)
{

12
js/src/jsapi.h
View File

@ -3534,18 +3534,6 @@ JS_DefineFunctionById(JSContext *cx, JS::Handle<JSObject*> obj, JS::Handle<jsid>
extern JS_PUBLIC_API(JSObject *)
JS_CloneFunctionObject(JSContext *cx, JS::Handle<JSObject*> funobj, JS::Handle<JSObject*> parent);
namespace JS {
/*
* As above, but providing an explicit scope chain. scopeChain must not include
* the global object on it; that's implicit. It needs to contain the other
* objects that should end up on the clone's scope chain.
*/
extern JS_PUBLIC_API(JSObject *)
CloneFunctionObject(JSContext *cx, HandleObject funobj, AutoObjectVector &scopeChain);
} // namespace JS
/*
* Given a buffer, return false if the buffer might become a valid
* javascript statement with the addition of more lines. Otherwise return