XMLHttpRequest::DispatchPrematureAbortEvent doesn't root type before calling Event::Create

RESOLVED WORKSFORME

Status

()

--
critical
RESOLVED WORKSFORME
6 years ago
6 years ago

People

(Reporter: timeless, Unassigned)

Tracking

({csectype-oom})

Trunk
x86_64
Windows 7
csectype-oom
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(URL)

(Reporter)

Description

6 years ago
1601 XMLHttpRequest::DispatchPrematureAbortEvent(JSObject* aTarget,
1617   JSString* type = JS_NewStringCopyZ(cx, sEventStrings[aEventType]);
not rooted
1625     event = events::CreateGenericEvent(cx, type, false, false, false);

992 namespace events {
1008 CreateGenericEvent(JSContext* aCx, JSString* aType, bool aBubbles,
1009                    bool aCancelable, bool aMainRuntime)
1012   return Event::Create(aCx, global, aType, aBubbles, aCancelable, aMainRuntime);

33 class Event : public PrivatizableBase
90   Create(JSContext* aCx, JSObject* aParent, JSString* aType, bool aBubbles,
95     JSObject* obj = JS_NewObject(aCx, clasp, NULL, aParent);
GC
99       InitEventCommon(obj, priv, aType, aBubbles, aCancelable, true);
Root somewhere here - way too late
Over to workers!
Component: DOM: Core & HTML → DOM: Workers
This will be handled by the stack scanner.
Status: UNCONFIRMED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → WORKSFORME
Group: core-security
You need to log in before you can comment on or make changes to this bug.