899696 - Fix unsafe references on SendToGenerator

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Terrence Cole [:terrence]]

Attachment: ur_SendToGenerator-v0.diff

This one is trivial to make into a HandleValue.

Comment 1

[Steve Fink [:sfink] [:s:]]

Comment on attachment 783264 [details] [diff] [review]
ur_SendToGenerator-v0.diff

Review of attachment 783264 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jsiter.cpp
@@ +1657,5 @@
>          return false;
>      }
>  
>      if (!SendToGenerator(cx, JSGENOP_SEND, thisObj, gen,
> +                         args.length() > 0 ? args[0] : JS::UndefinedHandleValue))

args.get(0)

@@ +1715,5 @@
>          return false;
>      }
>  
>      if (!SendToGenerator(cx, JSGENOP_THROW, thisObj, gen,
> +                         args.length() > 0 ? args[0] : JS::UndefinedHandleValue))

args.get(0)

Comment 2

[Terrence Cole [:terrence]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/6088d5708497

Comment 3

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/6088d5708497