Fix unsafe JS::Value reference in ConvertJSValueToString

RESOLVED FIXED in mozilla24

Status

()

Core
DOM
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: bz, Assigned: bz)

Tracking

unspecified
mozilla24
x86
Mac OS X
Points:
---
Bug Flags:
in-testsuite -

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

We should just have a handle here, I suspect.
Created attachment 753612 [details] [diff] [review]
part 1.  Pass through mutable handles to all the various places where we have to work with JS::Value in codegen.
Attachment #753612 - Flags: review?(bugs)
Created attachment 753613 [details] [diff] [review]
part 2.  Use handles in ConvertJSValueToString.
Attachment #753613 - Flags: review?(bugs)
Whiteboard: [need review]

Updated

5 years ago
Attachment #753612 - Flags: review?(bugs) → review+

Comment 3

5 years ago
Comment on attachment 753613 [details] [diff] [review]
part 2.  Use handles in ConvertJSValueToString.

Why don't we get Handle as param to nsGenericHTMLElement::SetItemValue?
Attachment #753613 - Flags: review?(bugs) → review+
> Why don't we get Handle as param to nsGenericHTMLElement::SetItemValue?

The bindings used to pass raw Value and I didn't update all callees when I changed them to pass in handles.  But it wouldn't help here anyway, since we need a MutableHandle here too, so we'd still need to set up the Rooted.
https://hg.mozilla.org/mozilla-central/rev/57c0aeecd749
https://hg.mozilla.org/mozilla-central/rev/ff4d7b275942
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.