Closed Bug 899696 Opened 6 years ago Closed 6 years ago

Fix unsafe references on SendToGenerator

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla25

People

(Reporter: terrence, Assigned: terrence)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

This one is trivial to make into a HandleValue.
Attachment #783264 - Flags: review?(sphink)
Comment on attachment 783264 [details] [diff] [review]
ur_SendToGenerator-v0.diff

Review of attachment 783264 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jsiter.cpp
@@ +1657,5 @@
>          return false;
>      }
>  
>      if (!SendToGenerator(cx, JSGENOP_SEND, thisObj, gen,
> +                         args.length() > 0 ? args[0] : JS::UndefinedHandleValue))

args.get(0)

@@ +1715,5 @@
>          return false;
>      }
>  
>      if (!SendToGenerator(cx, JSGENOP_THROW, thisObj, gen,
> +                         args.length() > 0 ? args[0] : JS::UndefinedHandleValue))

args.get(0)
Attachment #783264 - Flags: review?(sphink) → review+
https://hg.mozilla.org/mozilla-central/rev/6088d5708497
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla25
You need to log in before you can comment on or make changes to this bug.