зеркало из https://github.com/mozilla/gecko-dev.git
559be5f874
This bug happens when we take the !useSandbox path. Basically, when the code throws, we can end up with garbage in *aRetValue while still returning true from EvaluateString. It looks like the convention is for these kind of eval functions to return success even for invalid code, so lets just make sure we check things a bit better. This crashtest is kind of half-baked in the sense that it doesn't actually crash without the rest of the patch. But the testcase here involves a lot of undefined behavior (what ends up getting left in *aRetValue) during a call to window.open (which spins the event loop, etc). I already sunk about half an hour into trying to make it crash, so I'm just going to go with this for now. |
||
|---|---|---|
| .. | ||
| crashtests | ||
| test | ||
| Makefile.in | ||
| nsJSProtocolHandler.cpp | ||
| nsJSProtocolHandler.h | ||