1134730 - DOM proxy finalizers will crash if wrapping failed

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Boris Zbarsky [:bzbarsky]]

Because they use UnwrapProxy but that assumes the private slot is a private value, whereas ~BindingJSObjectCreator will have set it to undefined.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: DOM proxy finalizers should not assume that the JS object has an actual reference to the DOM object (and in particular that the slot it's stored in is a private slot)

Comment 2

[Boris Zbarsky [:bzbarsky]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1646d594dd7b

Comment 3

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/1646d594dd7b