Fix for bug 723465 (Make finalize for DOM list bindings use XPConnect).

--HG-- extra : rebase_source : e4df7d98765aaa2c600044d69f8714568f1d6109
2012-04-27 10:15:40 +02:00 · 2012-04-27 10:15:40 +02:00 · bd962257f1
--- a/js/xpconnect/crashtests/723465.html
+++ b/js/xpconnect/crashtests/723465.html
@ -0,0 +1,19 @@
+<html>
+<head>
+
+<script>
+
+function boom()
+{
+  var f = document.getElementById("f");
+  var fd = f.contentDocument;
+  fd.querySelectorAll("*");
+  fd.documentElement.innerHTML = "3";
+  document.body.removeChild(f);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><iframe id="f" src="data:text/html,<html><head onfocus=2>"></iframe></body>
+</html>
--- a/js/xpconnect/crashtests/crashtests.list
+++ b/js/xpconnect/crashtests/crashtests.list
@ -35,3 +35,4 @@ load 616930-1.html
 load 639737-1.html
 load 648206-1.html
 load 705875.html
+load 723465.html
--- a/js/xpconnect/src/dombindings.cpp
+++ b/js/xpconnect/src/dombindings.cpp
@ -1254,7 +1254,13 @@ ListBase<LC>::finalize(JSFreeOp *fop, JSObject *proxy)
    if (cache) {
        cache->ClearWrapper();
    }
-    NS_RELEASE(list);
+    XPCJSRuntime *rt = nsXPConnect::GetRuntimeInstance();
+    if (rt) {
+        rt->DeferredRelease(nativeToSupports(list));
+    }
+    else {
+        NS_RELEASE(list);
+    }
 }


--- a/js/xpconnect/src/dombindings.h
+++ b/js/xpconnect/src/dombindings.h
@ -125,6 +125,10 @@ public:
        *found = false;
        return true;
    }
+    static nsISupports* nativeToSupports(nsISupports* aNative)
+    {
+        return aNative;
+    }
 };

 template<class ListType, class IndexOps, class NameOps=NoOps>
@ -249,6 +253,10 @@ public:
    static bool nativeGet(JSContext *cx, JSObject *proxy, JSObject *proto, jsid id, bool *found,
                          JS::Value *vp);
    static ListType *getNative(JSObject *proxy);
+    static nsISupports* nativeToSupports(ListType* aNative)
+    {
+        return Base::nativeToSupports(aNative);
+    }
 };

 struct nsISupportsResult