Bug 723894 - Crash when Web IDL dictionary object is null; r=mrbkap

2012-02-05 18:57:46 +00:00 · 2012-02-05 18:57:46 +00:00 · 3f8d4b4f44
--- a/content/events/crashtests/crashtests.list
+++ b/content/events/crashtests/crashtests.list
@ -5,5 +5,6 @@ load 422009-1.xhtml
 load 457776-1.html
 load 496308-1.html
 load 682637-1.html
+load eventctor-nulldictionary.html
 load recursive-onload.html
 load recursive-DOMNodeInserted.html
--- a/content/events/crashtests/eventctor-nulldictionary.html
+++ b/content/events/crashtests/eventctor-nulldictionary.html
@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+new MouseEvent("click", null);
+</script>
--- a/js/xpconnect/src/dictionary_helper_gen.py
+++ b/js/xpconnect/src/dictionary_helper_gen.py
@ -381,8 +381,8 @@ def write_cpp(iface, fd):
             "  if (!aCx || !aVal) {\n"
             "    return NS_OK;\n"
             "  }\n"
-             "  NS_ENSURE_STATE(JSVAL_IS_OBJECT(*aVal));\n\n"
-             "  JSObject* obj = JSVAL_TO_OBJECT(*aVal);\n"
+             "  NS_ENSURE_STATE(aVal->isObject());\n\n"
+             "  JSObject* obj = &aVal->toObject();\n"
             "  nsCxPusher pusher;\n"
             "  NS_ENSURE_STATE(pusher.Push(aCx, false));\n"
             "  JSAutoRequest ar(aCx);\n"