From a242cf1cfd2ec4bd130cbe69331592a50f2da309 Mon Sep 17 00:00:00 2001 From: "mrbkap%gmail.com" Date: Thu, 6 Mar 2008 20:16:42 +0000 Subject: [PATCH] Protect |accum| from being collected in js_ConcatStrings. bug 393874, r=igor a=beltzner git-svn-id: svn://10.0.0.236/trunk@247233 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/js/src/jsparse.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/mozilla/js/src/jsparse.c b/mozilla/js/src/jsparse.c index 367c283a958..60b87c5298e 100644 --- a/mozilla/js/src/jsparse.c +++ b/mozilla/js/src/jsparse.c @@ -6021,6 +6021,7 @@ FoldXMLConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc) JSParseNode **pnp, *pn1, *pn2; JSString *accum, *str; uint32 i, j; + JSTempValueRooter tvr; JS_ASSERT(pn->pn_arity == PN_LIST); tt = PN_TYPE(pn); @@ -6034,6 +6035,13 @@ FoldXMLConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc) accum = ATOM_TO_STRING(cx->runtime->atomState.stagoAtom); } + /* + * GC Rooting here is tricky: for most of the loop, |accum| is safe via + * the newborn string root. However, when |pn2->pn_type| is TOK_XMLCDATA, + * TOK_XMLCOMMENT, or TOK_XMLPI it is knocked out of the newborn root. + * Therefore, we have to add additonal protection from GC nesting under + * js_ConcatStrings. + */ for (pn2 = pn1, i = j = 0; pn2; pn2 = pn2->pn_next, i++) { /* The parser already rejected end-tags with attributes. */ JS_ASSERT(tt != TOK_XMLETAGO || i == 0); @@ -6104,9 +6112,11 @@ FoldXMLConstants(JSContext *cx, JSParseNode *pn, JSTreeContext *tc) } if (accum) { + JS_PUSH_TEMP_ROOT_STRING(cx, accum, &tvr); str = ((tt == TOK_XMLSTAGO || tt == TOK_XMLPTAGC) && i != 0) ? js_AddAttributePart(cx, i & 1, accum, str) : js_ConcatStrings(cx, accum, str); + JS_POP_TEMP_ROOT(cx, &tvr); if (!str) return JS_FALSE; #ifdef DEBUG_brendanXXX