зеркало из https://github.com/mozilla/gecko-dev.git
Bug 862092 - "Assertion failure: target->isNative() == obj->isNative()" adopting a <select>. r=bz.
--HG-- extra : rebase_source : 3eef5382c32927ac321db47003a974768cbdaf6e
This commit is contained in:
Peter Van der Beken
Родитель
9a0980c363
Коммит
269a1f1f10
|
|
@ -1469,6 +1469,12 @@ ReparentWrapper(JSContext* aCx, JS::HandleObject aObjArg)
|
|||
return NS_ERROR_FAILURE;
|
||||
}
|
||||
|
||||
bool isProxy = js::IsProxy(aObj);
|
||||
JSObject* expandoObject;
|
||||
if (isProxy) {
|
||||
expandoObject = DOMProxyHandler::GetAndClearExpandoObject(aObj);
|
||||
}
|
||||
|
||||
JSAutoCompartment newAc(aCx, newParent);
|
||||
|
||||
// First we clone the reflector. We get a copy of its properties and clone its
|
||||
|
|
@ -1497,18 +1503,23 @@ ReparentWrapper(JSContext* aCx, JS::HandleObject aObjArg)
|
|||
// clearing |aObj|'s reserved slot the reserved slot of |newobj| will be
|
||||
// set to null. |aObj| will go away soon, because we swap it with
|
||||
// another object during the transplant and let that object die.
|
||||
JSObject *propertyHolder;
|
||||
JSObject* propertyHolder;
|
||||
{
|
||||
AutoCloneDOMObjectSlotGuard cloneGuard(aObj, newobj);
|
||||
|
||||
propertyHolder = JS_NewObjectWithGivenProto(aCx, nullptr, nullptr,
|
||||
newParent);
|
||||
if (!propertyHolder) {
|
||||
return NS_ERROR_OUT_OF_MEMORY;
|
||||
}
|
||||
JSObject* copyFrom = isProxy ? expandoObject : aObj;
|
||||
if (copyFrom) {
|
||||
propertyHolder = JS_NewObjectWithGivenProto(aCx, nullptr, nullptr,
|
||||
newParent);
|
||||
if (!propertyHolder) {
|
||||
return NS_ERROR_OUT_OF_MEMORY;
|
||||
}
|
||||
|
||||
if (!JS_CopyPropertiesFrom(aCx, propertyHolder, aObj)) {
|
||||
return NS_ERROR_FAILURE;
|
||||
if (!JS_CopyPropertiesFrom(aCx, propertyHolder, copyFrom)) {
|
||||
return NS_ERROR_FAILURE;
|
||||
}
|
||||
} else {
|
||||
propertyHolder = nullptr;
|
||||
}
|
||||
|
||||
// Expandos from other compartments are attached to the target JS object.
|
||||
|
|
@ -1557,8 +1568,18 @@ ReparentWrapper(JSContext* aCx, JS::HandleObject aObjArg)
|
|||
cache->SetPreservingWrapper(false);
|
||||
cache->SetWrapper(aObj);
|
||||
cache->SetPreservingWrapper(preserving);
|
||||
if (!JS_CopyPropertiesFrom(aCx, aObj, propertyHolder)) {
|
||||
MOZ_CRASH();
|
||||
|
||||
if (propertyHolder) {
|
||||
JSObject* copyTo;
|
||||
if (isProxy) {
|
||||
copyTo = DOMProxyHandler::EnsureExpandoObject(aCx, aObj);
|
||||
} else {
|
||||
copyTo = aObj;
|
||||
}
|
||||
|
||||
if (!copyTo || !JS_CopyPropertiesFrom(aCx, copyTo, propertyHolder)) {
|
||||
MOZ_CRASH();
|
||||
}
|
||||
}
|
||||
|
||||
nsObjectLoadingContent* htmlobject;
|
||||
|
|
|
|||
|
|
@ -47,6 +47,16 @@ struct SetListBaseInformation
|
|||
|
||||
SetListBaseInformation gSetListBaseInformation;
|
||||
|
||||
// static
|
||||
JSObject*
|
||||
DOMProxyHandler::GetAndClearExpandoObject(JSObject* obj)
|
||||
{
|
||||
JSObject* expando = GetExpandoObject(obj);
|
||||
XPCWrappedNativeScope* scope = xpc::GetObjectScope(obj);
|
||||
scope->RemoveDOMExpandoObject(obj);
|
||||
js::SetProxyExtra(obj, JSPROXYSLOT_EXPANDO, UndefinedValue());
|
||||
return expando;
|
||||
}
|
||||
|
||||
// static
|
||||
JSObject*
|
||||
|
|
|
|||
|
|
@ -54,6 +54,7 @@ public:
|
|||
JS::Value v = js::GetProxyExtra(obj, JSPROXYSLOT_EXPANDO);
|
||||
return v.isUndefined() ? NULL : v.toObjectOrNull();
|
||||
}
|
||||
static JSObject* GetAndClearExpandoObject(JSObject* obj);
|
||||
static JSObject* EnsureExpandoObject(JSContext* cx, JSObject* obj);
|
||||
|
||||
const DOMClass& mClass;
|
||||
|
|
|
|||
|
|
@ -0,0 +1,19 @@
|
|||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<script>
|
||||
|
||||
function boom()
|
||||
{
|
||||
var frameDoc = document.getElementById("f").contentDocument;
|
||||
frameDoc.adoptNode(document.createElement("select"));
|
||||
}
|
||||
|
||||
</script>
|
||||
</head>
|
||||
|
||||
<body onload="boom();">
|
||||
<iframe id="f"></iframe>
|
||||
</body>
|
||||
</html>
|
||||
|
|
@ -5,3 +5,4 @@ load 832899.html
|
|||
load 860591.html
|
||||
load 860551.html
|
||||
load 862610.html
|
||||
load 862092.html
|
||||
|
|
|
|||
|
|
@ -72,6 +72,7 @@ MOCHITEST_FILES := \
|
|||
test_queryInterface.html \
|
||||
test_exceptionThrowing.html \
|
||||
test_bug852846.html \
|
||||
test_bug862092.html \
|
||||
$(NULL)
|
||||
|
||||
MOCHITEST_CHROME_FILES = \
|
||||
|
|
|
|||
|
|
@ -0,0 +1,37 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<!--
|
||||
https://bugzilla.mozilla.org/show_bug.cgi?id=862092
|
||||
-->
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>Test for Bug 862092</title>
|
||||
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
|
||||
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
|
||||
<script type="application/javascript">
|
||||
|
||||
/** Test for Bug 862092 **/
|
||||
|
||||
SimpleTest.waitForExplicitFinish();
|
||||
function runTest()
|
||||
{
|
||||
var frameDoc = document.getElementById("f").contentDocument;
|
||||
var a = document.createElement("select");
|
||||
a.expando = "test";
|
||||
a = frameDoc.adoptNode(a)
|
||||
is(a.expando, "test", "adoptNode needs to preserve expandos");
|
||||
SimpleTest.finish();
|
||||
}
|
||||
|
||||
</script>
|
||||
</head>
|
||||
<body onload="runTest();">
|
||||
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=862092">Mozilla Bug 862092</a>
|
||||
<p id="display"></p>
|
||||
<div id="content" style="display: none">
|
||||
<iframe id="f"></iframe>
|
||||
</div>
|
||||
<pre id="test">
|
||||
</pre>
|
||||
</body>
|
||||
</html>
|
||||
Загрузка…
Ссылка в новой задаче