Bug 862610. When we have named constructors, make sure we managed to set up an interface object before looking for them. r=peterv

2013-04-18 01:21:46 -04:00 · 2013-04-18 01:21:46 -04:00 · 5508e4bd90
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@ -1786,6 +1786,9 @@ class CGDefineDOMInterfaceMethod(CGAbstractMethod):
    def definition_body(self):
        if len(self.descriptor.interface.namedConstructors) > 0:
            getConstructor = """  JSObject* interfaceObject = GetConstructorObject(aCx, aGlobal);
+  if (!interfaceObject) {
+    return nullptr;
+  }
  for (unsigned slot = DOM_INTERFACE_SLOTS_BASE; slot < JSCLASS_RESERVED_SLOTS(&InterfaceObjectClass.mBase); ++slot) {
    JSObject* constructor = &js::GetReservedSlot(interfaceObject, slot).toObject();
    if (JS_GetFunctionId(JS_GetObjectFunction(constructor)) == JSID_TO_STRING(id)) {
--- a/dom/bindings/crashtests/862610.html
+++ b/dom/bindings/crashtests/862610.html
@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+  HTMLElement.prototype.__proto__ = Proxy.create({}, {});
+  try {
+    window.Image;
+  } finally {
+    // Restore our prototype so the test harnesses can deal with us
+    // We can't just assign to __proto__ because it lives on our proto chain
+    // and we messed that up.
+    var desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
+    desc.set.call(HTMLElement.prototype, Element.prototype);
+  }
+</script>
+</head>
+
+<body></body>
+</html>
--- a/dom/bindings/crashtests/crashtests.list
+++ b/dom/bindings/crashtests/crashtests.list
@ -4,3 +4,4 @@ load 822340-2.html
 load 832899.html
 load 860591.html
 load 860551.html
+load 862610.html