620947 - nsHTMLDocumentSH::DocumentAllGetProperty uses result and cache uninitalized if JSID_IS_INT(id) && JSID_TO_INT(id) < 0

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P1)

Description

[timeless]

8652 nsHTMLDocumentSH::DocumentAllGetProperty(JSContext *cx, JSObject *obj,
8653                                          jsid id, jsval *vp)
8654 {
8674   nsISupports *result;

* let JSID_IS_STRING(id) be false:
8678   if (JSID_IS_STRING(id)) {
8679     if (id == sLength_id) {
8686         return JS_FALSE;
8695         return JS_FALSE;
8700       return JS_TRUE;
8701     } else if (id != sTags_id) {
8706       result = doc->GetDocumentAllResult(str, &cache, &rv);
8713     }
8714     else {
8715       result = nsnull;
8716     }

* let JSID_IS_INT(id) be true
* let JSID_TO_INT(id) be < 0
8717   } else if (JSID_IS_INT(id) && JSID_TO_INT(id) >= 0) {
skip this:
8728     result = node;
8730   }

result is unintialized:
8732   if (result) {
8733     rv = WrapNative(cx, JS_GetGlobalForScopeChain(cx), result, cache, PR_TRUE, vp);

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Be a little more careful getting properties from document.all.

Comment 2

[Boris Zbarsky [:bzbarsky]]

I did verify that the mochitest asserts like crazy and then crashes without the patch.

This isn't a problem on branches, because |result| is an nsCOMPtr there.  On trunk, this regressed with bug 564266.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Pushed http://hg.mozilla.org/mozilla-central/rev/2382fb87cbe2