884245 - nsContentUtils::GetDocumentFromCaller() roots with a null context

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jon Coppeard (:jonco)]

The following code is obviously bogus:

1670 nsIDocument*
1671 nsContentUtils::GetDocumentFromCaller()
1672 {
1673   JSContext *cx = nullptr;
1674   JS::Rooted<JSObject*> obj(cx);

Comment 1

[Jon Coppeard (:jonco)]

Attachment: Proposed fix

Get the JSContext first via GetCurrentNativeCallContext()

Comment 2

[Bobby Holley (:bholley)]

Comment on attachment 764076 [details] [diff] [review]
Proposed fix

This isn't the fix we want. I'll attach a patch.

Comment 3

[Bobby Holley (:bholley)]

Attachment: Simplify nsContentUtils::GetDocumentFromCaller. v1

The first three lines of this function are an obvious bug. But the behavior in
general is also worrisome, because it's using antiquated XPConnect machinery
that will be less and less correct as we move to the new DOM bindings. Let's
just infer our global from the active compartment.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 764227 [details] [diff] [review]
Simplify nsContentUtils::GetDocumentFromCaller. v1

r=me

Comment 5

[Bobby Holley (:bholley)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e0452ad52421

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/e0452ad52421