790727 - XMLHttpRequest::DispatchPrematureAbortEvent doesn't root type before calling Event::Create

Status: RESOLVED WORKSFORME

(Core :: DOM: Workers, defect)

Description

[timeless]

1601 XMLHttpRequest::DispatchPrematureAbortEvent(JSObject* aTarget,
1617   JSString* type = JS_NewStringCopyZ(cx, sEventStrings[aEventType]);
not rooted
1625     event = events::CreateGenericEvent(cx, type, false, false, false);

992 namespace events {
1008 CreateGenericEvent(JSContext* aCx, JSString* aType, bool aBubbles,
1009                    bool aCancelable, bool aMainRuntime)
1012   return Event::Create(aCx, global, aType, aBubbles, aCancelable, aMainRuntime);

33 class Event : public PrivatizableBase
90   Create(JSContext* aCx, JSObject* aParent, JSString* aType, bool aBubbles,
95     JSObject* obj = JS_NewObject(aCx, clasp, NULL, aParent);
GC
99       InitEventCommon(obj, priv, aType, aBubbles, aCancelable, true);
Root somewhere here - way too late

Comment 2

[Boris Zbarsky [:bzbarsky]]

Over to workers!

Comment 3

[Ben Turner (not reading bugmail, use the needinfo flag!)]

This will be handled by the stack scanner.