From 78dad25bc357819c0b3867d7c4ca67bbf06498d0 Mon Sep 17 00:00:00 2001 From: Ryan VanderMeulen Date: Wed, 17 Apr 2013 11:48:34 -0400 Subject: [PATCH] Backed out changeset 409285b3f69c (bug 862092) for mochitest-2 failures on a CLOSED TREE. --- dom/bindings/BindingUtils.cpp | 41 ++++++------------------- dom/bindings/crashtests/862092.html | 19 ------------ dom/bindings/crashtests/crashtests.list | 1 - dom/bindings/test/Makefile.in | 1 - dom/bindings/test/test_bug862092.html | 37 ---------------------- 5 files changed, 9 insertions(+), 90 deletions(-) delete mode 100644 dom/bindings/crashtests/862092.html delete mode 100644 dom/bindings/test/test_bug862092.html diff --git a/dom/bindings/BindingUtils.cpp b/dom/bindings/BindingUtils.cpp index d54a504b1fae..85adf4ff3e3c 100644 --- a/dom/bindings/BindingUtils.cpp +++ b/dom/bindings/BindingUtils.cpp @@ -1492,37 +1492,24 @@ ReparentWrapper(JSContext* aCx, JS::HandleObject aObjArg) js::SetReservedSlot(newobj, DOM_OBJECT_SLOT, js::GetReservedSlot(aObj, DOM_OBJECT_SLOT)); - bool isProxy = js::IsProxy(aObj); - // At this point, both |aObj| and |newobj| point to the same native // which is bad, because one of them will end up being finalized with a // native it does not own. |cloneGuard| ensures that if we exit before // clearing |aObj|'s reserved slot the reserved slot of |newobj| will be // set to null. |aObj| will go away soon, because we swap it with // another object during the transplant and let that object die. - JSObject* propertyHolder; + JSObject *propertyHolder; { AutoCloneDOMObjectSlotGuard cloneGuard(aObj, newobj); - JSObject* copyFrom; - if (isProxy) { - copyFrom = DOMProxyHandler::GetExpandoObject(aObj); - } else { - copyFrom = aObj; + propertyHolder = JS_NewObjectWithGivenProto(aCx, nullptr, nullptr, + newParent); + if (!propertyHolder) { + return NS_ERROR_OUT_OF_MEMORY; } - if (copyFrom) { - propertyHolder = JS_NewObjectWithGivenProto(aCx, nullptr, nullptr, - newParent); - if (!propertyHolder) { - return NS_ERROR_OUT_OF_MEMORY; - } - - if (!JS_CopyPropertiesFrom(aCx, propertyHolder, copyFrom)) { - return NS_ERROR_FAILURE; - } - } else { - propertyHolder = nullptr; + if (!JS_CopyPropertiesFrom(aCx, propertyHolder, aObj)) { + return NS_ERROR_FAILURE; } // Expandos from other compartments are attached to the target JS object. @@ -1571,18 +1558,8 @@ ReparentWrapper(JSContext* aCx, JS::HandleObject aObjArg) cache->SetPreservingWrapper(false); cache->SetWrapper(aObj); cache->SetPreservingWrapper(preserving); - - if (propertyHolder) { - JSObject* copyTo; - if (isProxy) { - copyTo = DOMProxyHandler::EnsureExpandoObject(aCx, aObj); - } else { - copyTo = aObj; - } - - if (!copyTo || !JS_CopyPropertiesFrom(aCx, copyTo, propertyHolder)) { - MOZ_CRASH(); - } + if (!JS_CopyPropertiesFrom(aCx, aObj, propertyHolder)) { + MOZ_CRASH(); } nsObjectLoadingContent* htmlobject; diff --git a/dom/bindings/crashtests/862092.html b/dom/bindings/crashtests/862092.html deleted file mode 100644 index 1b31775a9797..000000000000 --- a/dom/bindings/crashtests/862092.html +++ /dev/null @@ -1,19 +0,0 @@ - - - - - - - - - - - diff --git a/dom/bindings/crashtests/crashtests.list b/dom/bindings/crashtests/crashtests.list index 7b3e58bb69f4..ea8e158fbc70 100644 --- a/dom/bindings/crashtests/crashtests.list +++ b/dom/bindings/crashtests/crashtests.list @@ -4,4 +4,3 @@ load 822340-2.html load 832899.html load 860591.html load 860551.html -load 862092.html diff --git a/dom/bindings/test/Makefile.in b/dom/bindings/test/Makefile.in index 7a88add9657a..4ea6e7f8753b 100644 --- a/dom/bindings/test/Makefile.in +++ b/dom/bindings/test/Makefile.in @@ -72,7 +72,6 @@ MOCHITEST_FILES := \ test_queryInterface.html \ test_exceptionThrowing.html \ test_bug852846.html \ - test_bug862092.html \ $(NULL) MOCHITEST_CHROME_FILES = \ diff --git a/dom/bindings/test/test_bug862092.html b/dom/bindings/test/test_bug862092.html deleted file mode 100644 index 4b0633328105..000000000000 --- a/dom/bindings/test/test_bug862092.html +++ /dev/null @@ -1,37 +0,0 @@ - - - - - - Test for Bug 862092 - - - - - -Mozilla Bug 862092 -

- -
-
- -