Bug 768750 - Make FieldSetter always set a return value. r=bz, a=lsblakk

--HG-- extra : rebase_source : fe20fedc5abc5140feb19728e056fe894bf36998
2012-10-17 13:42:58 -07:00 · 2012-10-17 13:42:58 -07:00 · b863a25404
--- a/content/xbl/crashtests/crashtests.list
+++ b/content/xbl/crashtests/crashtests.list
@ -35,3 +35,4 @@ asserts-if(Android,2) load 493123-1.xhtml
 load 495354-1.xhtml
 load 507628-1.xhtml
 load 507991-1.xhtml
+load set-field-bad-this.xhtml
--- a/content/xbl/crashtests/set-field-bad-this.xhtml
+++ b/content/xbl/crashtests/set-field-bad-this.xhtml
@ -0,0 +1,31 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+  <title>Gracefully handle setting a field on a bad |this|</title>
+
+  <bindings xmlns="http://www.mozilla.org/xbl">
+    <binding id="a">
+      <implementation>
+        <field name="f">17</field>
+      </implementation>
+    </binding>
+  </bindings>
+
+  <script type="application/javascript">
+    window.onload = function()
+    {
+      var bound = document.getElementById("bound");
+      try
+      {
+        Object.getPrototypeOf(bound).f = 42;
+      }
+      catch (e) { /* Throwing's fine, crashing isn't. */ }
+    };
+  </script>
+</head>
+
+<body>
+  <div id="bound" style="-moz-binding: url(#a)"></div>
+</body>
+
+</html>
--- a/content/xbl/src/nsXBLBinding.cpp
+++ b/content/xbl/src/nsXBLBinding.cpp
@ -262,9 +262,15 @@ FieldSetterImpl(JSContext *cx, JS::CallArgs args)
    return false;
  }

-  js::Rooted<JS::Value> v(cx,
-                          args.length() > 0 ? args[0] : JS::UndefinedValue());
-  return JS_SetPropertyById(cx, thisObj, id, v.address());
+  if (installed) {
+    js::Rooted<JS::Value> v(cx,
+                            args.length() > 0 ? args[0] : JS::UndefinedValue());
+    if (!::JS_SetPropertyById(cx, thisObj, id, v.address())) {
+      return false;
+    }
+  }
+  args.rval().setUndefined();
+  return true;
 }

 static JSBool