616401 - nsHTMLCanvasElement::GetContext ignores JS exceptions

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Luke Wagner [:luke]]

nsHTMLCanvasElement::GetContext has a loop to the effect:

  for (...) {
    if (!JS_IdToValue(...) && !JS_GetPropertyById(...))
      continue;
    ...
  }

Thus, any exception thrown by JS_GetPropertyById (getter, invalid prop access) will be ignored or overwritten.  I'm no expert in the area, so maybe there is some higher-level design, perhaps some property of aContextOptions, that makes this not a problem.

Also, the return value of JS_ValueToString isn't tested for null.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Neither http://www.whatwg.org/specs/web-apps/current-work/complete/the-canvas-element.html#dom-canvas-getcontext nor https://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/doc/spec/WebGL-spec.html#WEBGLCONTEXTATTRIBUTES seem to consider the possibility of exceptions here, and hence don't define behavior in those situations.  They probably need to do that.

Vlad, the webgl spec is probably where this should live....

Comment 2

[Benoit Jacob [:bjacob] (mostly away)]

Blocking webgl-conformance so we can't forget this.

Comment 3

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Attachment: Patch v1

Comment 4

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Attachment: Patch v1 (diff -w)

Comment 5

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 621301 [details] [diff] [review]
Patch v1

diff -w would have been nice....

r=me

Comment 6

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

https://hg.mozilla.org/mozilla-central/rev/09df0008b156

(In reply to Boris Zbarsky (:bz) from comment #5)
> Comment on attachment 621301 [details] [diff] [review]
> Patch v1
> 
> diff -w would have been nice....
> 
> r=me

Er, attachment 621302 [details] [diff] [review]?

Comment 7

[Boris Zbarsky [:bzbarsky]]

Er, indeed....