From 7036d41859a048b108d0485feb8cdc201fd64595 Mon Sep 17 00:00:00 2001 From: Boris Zbarsky Date: Tue, 6 Sep 2011 22:57:46 -0400 Subject: [PATCH] Bug 684544. Restore missing null-check for location setter. r=mrbkap --- dom/base/nsDOMClassInfo.cpp | 25 +++++++--- dom/tests/mochitest/bugs/Makefile.in | 1 + dom/tests/mochitest/bugs/test_bug684544.html | 48 ++++++++++++++++++++ 3 files changed, 67 insertions(+), 7 deletions(-) create mode 100644 dom/tests/mochitest/bugs/test_bug684544.html diff --git a/dom/base/nsDOMClassInfo.cpp b/dom/base/nsDOMClassInfo.cpp index 909145ef494a..c42954b7bd40 100644 --- a/dom/base/nsDOMClassInfo.cpp +++ b/dom/base/nsDOMClassInfo.cpp @@ -6378,19 +6378,30 @@ LocationSetterGuts(JSContext *cx, JSObject *obj, jsval *vp) nsresult rv = xpcomObj->GetLocation(getter_AddRefs(location)); NS_ENSURE_SUCCESS(rv, rv); + // Grab the value we're being set to before we stomp on |vp| JSString *val = ::JS_ValueToString(cx, *vp); NS_ENSURE_TRUE(val, NS_ERROR_UNEXPECTED); + // Make sure |val| stays alive below + JS::Anchor anchor(val); + + // We have to wrap location into vp before null-checking location, to + // avoid assigning the wrong thing into the slot. + nsCOMPtr holder; + rv = WrapNative(cx, JS_GetGlobalForScopeChain(cx), location, + &NS_GET_IID(nsIDOMLocation), PR_TRUE, vp, + getter_AddRefs(holder)); + NS_ENSURE_SUCCESS(rv, rv); + + if (!location) { + // Make this a no-op + return NS_OK; + } + nsDependentJSString depStr; NS_ENSURE_TRUE(depStr.init(cx, val), NS_ERROR_UNEXPECTED); - rv = location->SetHref(depStr); - NS_ENSURE_SUCCESS(rv, rv); - - nsCOMPtr holder; - return WrapNative(cx, JS_GetGlobalForScopeChain(cx), location, - &NS_GET_IID(nsIDOMLocation), PR_TRUE, vp, - getter_AddRefs(holder)); + return location->SetHref(depStr); } template diff --git a/dom/tests/mochitest/bugs/Makefile.in b/dom/tests/mochitest/bugs/Makefile.in index e9cfda6edce5..d7c64f786017 100644 --- a/dom/tests/mochitest/bugs/Makefile.in +++ b/dom/tests/mochitest/bugs/Makefile.in @@ -140,6 +140,7 @@ _TEST_FILES = \ test_bug642026.html \ test_bug648465.html \ test_bug654137.html \ + test_bug684544.html \ test_window_bar.html \ file_window_bar.html \ test_resize_move_windows.html \ diff --git a/dom/tests/mochitest/bugs/test_bug684544.html b/dom/tests/mochitest/bugs/test_bug684544.html new file mode 100644 index 000000000000..12c3a324d3f1 --- /dev/null +++ b/dom/tests/mochitest/bugs/test_bug684544.html @@ -0,0 +1,48 @@ + + + + + Test for Bug + + + + +Mozilla Bug +

+ +
+
+
+ +