зеркало из https://github.com/mozilla/gecko-dev.git
Bug 941784 - Fix an exact rooting hazard false positive in XMLHttpRequest::Send; r=bent
--HG-- extra : rebase_source : d27bf81bb50528c49ad1036e19fcef6040ae4575
This commit is contained in:
Родитель
9a66cefbf3
Коммит
bde6f281c2
|
@ -1965,8 +1965,12 @@ XMLHttpRequest::Send(const nsAString& aBody, ErrorResult& aRv)
|
|||
void
|
||||
XMLHttpRequest::Send(JSObject* aBody, ErrorResult& aRv)
|
||||
{
|
||||
mWorkerPrivate->AssertIsOnWorkerThread();
|
||||
JSContext* cx = mWorkerPrivate->GetJSContext();
|
||||
|
||||
MOZ_ASSERT(aBody);
|
||||
JS::Rooted<JSObject*> body(cx, aBody);
|
||||
|
||||
mWorkerPrivate->AssertIsOnWorkerThread();
|
||||
|
||||
if (mCanceled) {
|
||||
aRv.Throw(UNCATCHABLE_EXCEPTION);
|
||||
|
@ -1978,15 +1982,13 @@ XMLHttpRequest::Send(JSObject* aBody, ErrorResult& aRv)
|
|||
return;
|
||||
}
|
||||
|
||||
JSContext* cx = mWorkerPrivate->GetJSContext();
|
||||
|
||||
JS::Rooted<JS::Value> valToClone(cx);
|
||||
if (JS_IsArrayBufferObject(aBody) || JS_IsArrayBufferViewObject(aBody) ||
|
||||
file::GetDOMBlobFromJSObject(aBody)) {
|
||||
valToClone.setObject(*aBody);
|
||||
if (JS_IsArrayBufferObject(body) || JS_IsArrayBufferViewObject(body) ||
|
||||
file::GetDOMBlobFromJSObject(body)) {
|
||||
valToClone.setObject(*body);
|
||||
}
|
||||
else {
|
||||
JS::Rooted<JS::Value> obj(cx, JS::ObjectValue(*aBody));
|
||||
JS::Rooted<JS::Value> obj(cx, JS::ObjectValue(*body));
|
||||
JSString* bodyStr = JS::ToString(cx, obj);
|
||||
if (!bodyStr) {
|
||||
aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
|
||||
|
|
Загрузка…
Ссылка в новой задаче