623441 - JSCompartment::wrap missing oom check

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Luke Wagner [:luke]]

Namely:
 JetpackChild.cpp : ReportError
 Handle.h : GetParent, CreateHandle
 xpcconvert.cpp: NativeInterface2JSObject/CreateHolderIfNeeded
 xpccomponents.cpp : CallOrConstruct, GetGlobalForObject
 nsNPAPIPluggin.cpp: _evaluate
 ObjectWrapperParent.cpp : jsval_from_PObjectWrapperParent
 nsJSEnvironment.cpp : nsJSContext::SetProperty
 nsDOMClassInfo.cpp : nsWindowSH::GetProperty
 nsScriptableRegion.cpp : GetRects

dmandelin and I found these while investigating bug 605290: several of these flow into 'jsval' IDL outparams which would then explode in JSCompartment::wrap when it was called by GatherAndConvertOutparams in XPCNW::CallMethod fixing this will fix that bug.

Comment 1

[Luke Wagner [:luke]]

Oh duh, I just remembered while putting Scott to sleep that

  JSVAL_IS_OBJECT === js::Value::isObjectOrNull
  OBJECT_TO_JSVAL === js::Value::setObjectOrNull

so all the above cases aren't actually bugs.  (For fatvals, I didn't want to change the semantics of these public API functions since that would effectively force embeddings (incl. mozilla) to do a whole-program data-flow analysis.)

So it looks like, for bug 605190, the princess is in another castle.

Comment 2

[Luke Wagner [:luke]]

Attachment: check for null in JSCompartment::wrap

Well, the bug isn't totally invalid; there is one pretty central site using the internal API which doesn't check for null.

Comment 3

[Luke Wagner [:luke]]

http://hg.mozilla.org/tracemonkey/rev/8a1715b0aeae

Comment 4

[Chris Leary [:cdleary] (not checking bugmail)]

http://hg.mozilla.org/mozilla-central/rev/8a1715b0aeae