DOM proxy finalizers will crash if wrapping failed

RESOLVED FIXED in Firefox 39

Status

()

Core
DOM
RESOLVED FIXED
3 years ago
3 years ago

People

(Reporter: bz, Assigned: bz)

Tracking

Trunk
mozilla39
x86
Mac OS X
Points:
---

Firefox Tracking Flags

(firefox39 fixed)

Details

Attachments

(1 attachment)

Because they use UnwrapProxy but that assumes the private slot is a private value, whereas ~BindingJSObjectCreator will have set it to undefined.
Created attachment 8566636 [details] [diff] [review]
DOM proxy finalizers should not assume that the JS object has an actual reference to the DOM object (and in particular that the slot it's stored in is a private slot)
Attachment #8566636 - Flags: review?(peterv)
Attachment #8566636 - Flags: review?(peterv) → review+
https://hg.mozilla.org/mozilla-central/rev/1646d594dd7b
Status: NEW → RESOLVED
Last Resolved: 3 years ago
status-firefox39: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla39
You need to log in before you can comment on or make changes to this bug.