Closed Bug 875622 Opened 11 years ago Closed 11 years ago

Fix unsafe JS::Value reference in ConvertJSValueToString

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla24

People

(Reporter: bzbarsky, Assigned: bzbarsky)

References

Details

Attachments

(2 files)

part 1. Pass through mutable handles to all the various places where we have to work with JS::Value in codegen.
(deleted), patch
smaug
: review+
Details | Diff | Splinter Review
part 2. Use handles in ConvertJSValueToString.
(deleted), patch
smaug
: review+
Details | Diff | Splinter Review
We should just have a handle here, I suspect.
Attachment #753613 - Flags: review?(bugs)
Whiteboard: [need review]
Attachment #753612 - Flags: review?(bugs) → review+
Comment on attachment 753613 [details] [diff] [review] part 2. Use handles in ConvertJSValueToString. Why don't we get Handle as param to nsGenericHTMLElement::SetItemValue?
Attachment #753613 - Flags: review?(bugs) → review+
> Why don't we get Handle as param to nsGenericHTMLElement::SetItemValue? The bindings used to pass raw Value and I didn't update all callees when I changed them to pass in handles. But it wouldn't help here anyway, since we need a MutableHandle here too, so we'd still need to set up the Rooted.
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: