Bug 658746 - "Assertion failure: JSID_IS_STRING(id)" with dataset[0].

Fixed incorrect handling of integer jsid to access dataset properties. Converted integer jsids to strings. Added checks to ensure jsids are strings when using them as strings. r=sicking
This commit is contained in:
William Chen 2011-05-23 15:53:12 -07:00
Родитель f54a4198c8
Коммит 2fa38e010c
4 изменённых файлов: 131 добавлений и 11 удалений

Просмотреть файл

@ -276,6 +276,7 @@ _TEST_FILES = \
test_bug514437.html \ test_bug514437.html \
test_bug560112.html \ test_bug560112.html \
test_bug649134.html \ test_bug649134.html \
test_bug658746.html \
$(NULL) $(NULL)
libs:: $(_TEST_FILES) libs:: $(_TEST_FILES)

Просмотреть файл

@ -0,0 +1,98 @@
<!DOCTYPE HTML>
<html>
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=658746
-->
<head>
<title>Test for Bug 658746</title>
<script type="application/javascript" src="/MochiKit/packed.js"></script>
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
</head>
<body>
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=658746">Mozilla Bug 658746</a>
<p id="display"></p>
<div id="content" style="display: none">
</div>
<pre id="test">
<script type="application/javascript">
/** Test for Bug 658746 **/
/**
* Sets property, gets property and deletes property.
*/
function SetGetDelete(prop)
{
var el = document.createElement('div');
el.dataset[prop] = 'aaaaaa';
is(el.dataset[prop], 'aaaaaa', 'Dataset property "' + prop + '" should have been set.');
delete el.dataset[prop];
is(el.dataset[prop], undefined, 'Dataset property"' + prop + '" should have been deleted.');
}
/**
* Gets, deletes and sets property. Expects exception while trying to set property.
*/
function SetExpectException(prop)
{
var el = document.createElement('div');
is(el.dataset[prop], undefined, 'Dataset property "' + prop + '" should be undefined.');
delete el.dataset[prop];
try {
el.dataset[prop] = "xxxxxx";
ok(false, 'Exception should have been thrown when setting "' + prop + '".');
} catch (ex) {
ok(true, 'Exception should have been thrown.');
}
}
// Numbers as properties.
SetGetDelete(-12345678901234567980);
SetGetDelete(-1);
SetGetDelete(0);
SetGetDelete(1);
SetGetDelete(12345678901234567980);
// Floating point numbers as properties.
SetGetDelete(-1.1);
SetGetDelete(0.0);
SetGetDelete(1.1);
// Hexadecimal numbers as properties.
SetGetDelete(0x3);
SetGetDelete(0xa);
// Octal numbers as properties.
SetGetDelete(03);
SetGetDelete(07);
// String numbers as properties.
SetGetDelete('0');
SetGetDelete('01');
SetGetDelete('0x1');
// Undefined as property.
SetGetDelete(undefined);
// Empty arrays as properties.
SetGetDelete(new Array());
SetGetDelete([]);
// Non-empty array and object as properties.
SetExpectException(['a', 'b']);
SetExpectException({'a':'b'});
// Objects as properties.
SetExpectException(new Object());
SetExpectException(document);
</script>
</pre>
</body>
</html>

Просмотреть файл

@ -8590,7 +8590,8 @@ nsDOMStringMapSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
nsCOMPtr<nsIDOMDOMStringMap> dataset(do_QueryWrappedNative(wrapper, obj)); nsCOMPtr<nsIDOMDOMStringMap> dataset(do_QueryWrappedNative(wrapper, obj));
NS_ENSURE_TRUE(dataset, NS_ERROR_UNEXPECTED); NS_ENSURE_TRUE(dataset, NS_ERROR_UNEXPECTED);
nsDependentJSString prop(id); nsAutoString prop;
NS_ENSURE_TRUE(JSIDToProp(id, prop), NS_ERROR_UNEXPECTED);
if (dataset->HasDataAttr(prop)) { if (dataset->HasDataAttr(prop)) {
*_retval = JS_DefinePropertyById(cx, obj, id, JSVAL_VOID, *_retval = JS_DefinePropertyById(cx, obj, id, JSVAL_VOID,
@ -8658,9 +8659,10 @@ nsDOMStringMapSH::DelProperty(nsIXPConnectWrappedNative *wrapper,
{ {
nsCOMPtr<nsIDOMDOMStringMap> dataset(do_QueryWrappedNative(wrapper, obj)); nsCOMPtr<nsIDOMDOMStringMap> dataset(do_QueryWrappedNative(wrapper, obj));
NS_ENSURE_TRUE(dataset, NS_ERROR_UNEXPECTED); NS_ENSURE_TRUE(dataset, NS_ERROR_UNEXPECTED);
*_retval = PR_TRUE;
nsDependentJSString prop(id); nsAutoString prop;
NS_ENSURE_TRUE(JSIDToProp(id, prop), NS_ERROR_UNEXPECTED);
dataset->RemoveDataAttr(prop); dataset->RemoveDataAttr(prop);
return NS_OK; return NS_OK;
@ -8674,21 +8676,22 @@ nsDOMStringMapSH::GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
nsCOMPtr<nsIDOMDOMStringMap> dataset(do_QueryWrappedNative(wrapper, obj)); nsCOMPtr<nsIDOMDOMStringMap> dataset(do_QueryWrappedNative(wrapper, obj));
NS_ENSURE_TRUE(dataset, NS_ERROR_UNEXPECTED); NS_ENSURE_TRUE(dataset, NS_ERROR_UNEXPECTED);
nsDependentJSString propName(id); nsAutoString propName;
nsAutoString prop; NS_ENSURE_TRUE(JSIDToProp(id, propName), NS_ERROR_UNEXPECTED);
nsresult rv = dataset->GetDataAttr(propName, prop); nsAutoString propVal;
nsresult rv = dataset->GetDataAttr(propName, propVal);
NS_ENSURE_SUCCESS(rv, rv); NS_ENSURE_SUCCESS(rv, rv);
if (prop.IsVoid()) { if (propVal.IsVoid()) {
*vp = JSVAL_VOID; *vp = JSVAL_VOID;
return NS_SUCCESS_I_DID_SOMETHING; return NS_SUCCESS_I_DID_SOMETHING;
} }
nsStringBuffer* valBuf; nsStringBuffer* valBuf;
*vp = XPCStringConvert::ReadableToJSVal(cx, prop, &valBuf); *vp = XPCStringConvert::ReadableToJSVal(cx, propVal, &valBuf);
if (valBuf) { if (valBuf) {
prop.ForgetSharedBuffer(); propVal.ForgetSharedBuffer();
} }
return NS_SUCCESS_I_DID_SOMETHING; return NS_SUCCESS_I_DID_SOMETHING;
@ -8702,10 +8705,12 @@ nsDOMStringMapSH::SetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
nsCOMPtr<nsIDOMDOMStringMap> dataset(do_QueryWrappedNative(wrapper, obj)); nsCOMPtr<nsIDOMDOMStringMap> dataset(do_QueryWrappedNative(wrapper, obj));
NS_ENSURE_TRUE(dataset, NS_ERROR_UNEXPECTED); NS_ENSURE_TRUE(dataset, NS_ERROR_UNEXPECTED);
nsAutoString propName;
NS_ENSURE_TRUE(JSIDToProp(id, propName), NS_ERROR_UNEXPECTED);
JSString *val = JS_ValueToString(cx, *vp); JSString *val = JS_ValueToString(cx, *vp);
NS_ENSURE_TRUE(val, NS_ERROR_UNEXPECTED); NS_ENSURE_TRUE(val, NS_ERROR_UNEXPECTED);
nsDependentJSString propName(id);
nsDependentJSString propVal; nsDependentJSString propVal;
NS_ENSURE_TRUE(propVal.init(cx, val), NS_ERROR_UNEXPECTED); NS_ENSURE_TRUE(propVal.init(cx, val), NS_ERROR_UNEXPECTED);
@ -8715,6 +8720,20 @@ nsDOMStringMapSH::SetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
return NS_SUCCESS_I_DID_SOMETHING; return NS_SUCCESS_I_DID_SOMETHING;
} }
bool
nsDOMStringMapSH::JSIDToProp(const jsid& aId, nsAString& aResult)
{
if (JSID_IS_INT(aId)) {
aResult.AppendInt(JSID_TO_INT(aId));
} else if (JSID_IS_STRING(aId)) {
aResult = nsDependentJSString(aId);
} else {
return false;
}
return true;
}
NS_IMETHODIMP NS_IMETHODIMP
nsDocumentSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx, nsDocumentSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
JSObject *obj, jsid id, PRUint32 flags, JSObject *obj, jsid id, PRUint32 flags,

Просмотреть файл

@ -925,6 +925,8 @@ public:
NS_IMETHOD SetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx, NS_IMETHOD SetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
JSObject *obj, jsid id, jsval *vp, PRBool *_retval); JSObject *obj, jsid id, jsval *vp, PRBool *_retval);
bool JSIDToProp(const jsid& aId, nsAString& aResult);
static nsIClassInfo *doCreate(nsDOMClassInfoData* aData) static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
{ {
return new nsDOMStringMapSH(aData); return new nsDOMStringMapSH(aData);