зеркало из https://github.com/mozilla/gecko-dev.git
Bug 684544. Restore missing null-check for location setter. r=mrbkap
This commit is contained in:
Boris Zbarsky
Родитель
e5154a071f
Коммит
7036d41859
|
|
@ -6378,19 +6378,30 @@ LocationSetterGuts(JSContext *cx, JSObject *obj, jsval *vp)
|
|||
nsresult rv = xpcomObj->GetLocation(getter_AddRefs(location));
|
||||
NS_ENSURE_SUCCESS(rv, rv);
|
||||
|
||||
// Grab the value we're being set to before we stomp on |vp|
|
||||
JSString *val = ::JS_ValueToString(cx, *vp);
|
||||
NS_ENSURE_TRUE(val, NS_ERROR_UNEXPECTED);
|
||||
|
||||
// Make sure |val| stays alive below
|
||||
JS::Anchor<JSString *> anchor(val);
|
||||
|
||||
// We have to wrap location into vp before null-checking location, to
|
||||
// avoid assigning the wrong thing into the slot.
|
||||
nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
|
||||
rv = WrapNative(cx, JS_GetGlobalForScopeChain(cx), location,
|
||||
&NS_GET_IID(nsIDOMLocation), PR_TRUE, vp,
|
||||
getter_AddRefs(holder));
|
||||
NS_ENSURE_SUCCESS(rv, rv);
|
||||
|
||||
if (!location) {
|
||||
// Make this a no-op
|
||||
return NS_OK;
|
||||
}
|
||||
|
||||
nsDependentJSString depStr;
|
||||
NS_ENSURE_TRUE(depStr.init(cx, val), NS_ERROR_UNEXPECTED);
|
||||
|
||||
rv = location->SetHref(depStr);
|
||||
NS_ENSURE_SUCCESS(rv, rv);
|
||||
|
||||
nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
|
||||
return WrapNative(cx, JS_GetGlobalForScopeChain(cx), location,
|
||||
&NS_GET_IID(nsIDOMLocation), PR_TRUE, vp,
|
||||
getter_AddRefs(holder));
|
||||
return location->SetHref(depStr);
|
||||
}
|
||||
|
||||
template<class Interface>
|
||||
|
|
|
|||
|
|
@ -140,6 +140,7 @@ _TEST_FILES = \
|
|||
test_bug642026.html \
|
||||
test_bug648465.html \
|
||||
test_bug654137.html \
|
||||
test_bug684544.html \
|
||||
test_window_bar.html \
|
||||
file_window_bar.html \
|
||||
test_resize_move_windows.html \
|
||||
|
|
|
|||
|
|
@ -0,0 +1,48 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<!--
|
||||
https://bugzilla.mozilla.org/show_bug.cgi?id=
|
||||
-->
|
||||
<head>
|
||||
<title>Test for Bug </title>
|
||||
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
|
||||
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
|
||||
</head>
|
||||
<body>
|
||||
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=">Mozilla Bug </a>
|
||||
<p id="display"></p>
|
||||
<div id="content" style="display: none">
|
||||
|
||||
</div>
|
||||
<pre id="test">
|
||||
<script type="application/javascript">
|
||||
|
||||
/** Test for Bug **/
|
||||
|
||||
var f = document.createElement("iframe");
|
||||
document.body.appendChild(f);
|
||||
var win = f.contentWindow;
|
||||
|
||||
// Set location once to make sure it's resolved
|
||||
win.location = "data:text/html,1";
|
||||
|
||||
// Now try to make the location object go away.
|
||||
f.parentNode.removeChild(f);
|
||||
|
||||
// Check that location is now null. If it's not, the test needs changing
|
||||
// (e.g. to use window.close() so that it's null).
|
||||
is("location" in win, true, "Should still have a location property");
|
||||
todo_is(win.location, null, "There should be no location object now");
|
||||
|
||||
// Just set the location. This should not crash.
|
||||
win.location = "data:text/html,2";
|
||||
|
||||
// And check that we didn't override the slot in the process.
|
||||
is(typeof(win.location), "object", "Location should not have become a string");
|
||||
is(win.location, null,
|
||||
"There should be no location object for real after the set");
|
||||
|
||||
</script>
|
||||
</pre>
|
||||
</body>
|
||||
</html>
|
||||
Загрузка…
Ссылка в новой задаче