611672 - NPN_Construct doesn't work on native JS functions

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Benjamin Smedberg]

NPN_Construct was added to NPAPI a while back, but currently it doesn't work on native JS functions. It only works in the other direction such that content JS can construct objects provided by the plugin. This is because of a logic error in nsJSNPRuntime which is calling JS_ConstructObjectWithArguments using js::FunctionClass instead of using JS_New, which constructs an object using the correct class.

Comment 1

[Benjamin Smedberg]

Attachment: Use JS_New, rev. 1

Comment 2

[Johnny Stenback (:jst)]

Comment on attachment 490093 [details] [diff] [review]
Use JS_New, rev. 1

- In modules/plugin/test/mochitest/test_npruntime_construct.html:

+  <style type="text/css">
+  body {
+    height: 4000px;
+  }
+  </style>

I don't mind this being here if it's for a reason, but I fail to see a reason for it here.

r=jst either way.

Comment 3

[Benjamin Smedberg]

Yeah, that was a bad copy-paste from test_positioning.html

http://hg.mozilla.org/mozilla-central/rev/fc492fc14c67 (with wrong bug#, bah)

Comment 4

[Josh Aas]

I just crashed trying to update Silverlight via Mozilla's plugincheck page with
the latest Minefield nightly on Mac OS X 10.6.5. I clicked on the update button
for Silverlight and crashed on the following Silverlight page:

http://www.microsoft.com/silverlight/get-started/install/default.aspx

Pretty easy to repro by reloading that URL, I only have to reload the page a couple of times to get it to happen.

My crash report is here:

http://crash-stats.mozilla.com/report/index/bp-c471f3a3-03df-4c14-b5c7-a76fd2101202

All four reports of this in our database for 4.0b8pre have come within the past two days. Two are from me.

This bug comes to mind as a potential cause because it was the last direct modification to NPRuntime and Silverlight is probably doing a lot of script interaction on that page.

Comment 5

[Josh Aas]

I filed bug 616400.