Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixing bug 486269. Prevent plugins from being destroyed while calling into them. r=joshmoz@gmail.com, sr=bzbarsky@mit.edu, a=dveditz@cruzio.com

Browse Source 
git-svn-id: svn://10.0.0.236/trunk@256969 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
jst%mozilla.org
2009-04-18 17:54:41 +00:00
parent 85940179ec
commit acc78670c3
1 changed files with 30 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
mozilla/modules/plugin/base/src/nsJSNPRuntime.cpp
View File

@@ -1148,6 +1148,8 @@ NPObjWrapper_AddProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
return JS_FALSE;
}
PluginDestructionGuard pdg(LookupNPP(npobj));
// We must permit methods here since JS_DefineUCFunction() will add
// the function as a property
if (!npobj->_class->hasProperty(npobj, (NPIdentifier)id) &&
@@ -1172,6 +1174,8 @@ NPObjWrapper_DelProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
return JS_FALSE;
}
PluginDestructionGuard pdg(LookupNPP(npobj));
if (!npobj->_class->hasProperty(npobj, (NPIdentifier)id)) {
ThrowJSException(cx, "Trying to remove unsupported property on scriptable "
"plugin object!");
@@ -1194,13 +1198,6 @@ NPObjWrapper_SetProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
return JS_FALSE;
}
if (!npobj->_class->hasProperty(npobj, (NPIdentifier)id)) {
ThrowJSException(cx, "Trying to set unsupported property on scriptable "
"plugin object!");
return JS_FALSE;
}
// Find out what plugin (NPP) is the owner of the object we're
// manipulating, and make it own any JSObject wrappers created here.
NPP npp = LookupNPP(npobj);
@@ -1211,6 +1208,15 @@ NPObjWrapper_SetProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
return JS_FALSE;
}
PluginDestructionGuard pdg(npp);
if (!npobj->_class->hasProperty(npobj, (NPIdentifier)id)) {
ThrowJSException(cx, "Trying to set unsupported property on scriptable "
"plugin object!");
return JS_FALSE;
}
NPVariant npv;
if (!JSValToNPVariant(npp, cx, *vp, &npv)) {
ThrowJSException(cx, "Error converting jsval to NPVariant!");
@@ -1245,20 +1251,19 @@ NPObjWrapper_GetProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
return JS_FALSE;
}
// Find out what plugin (NPP) is the owner of the object we're
// manipulating, and make it own any JSObject wrappers created here.
NPP npp = LookupNPP(npobj);
if (!npp) {
ThrowJSException(cx, "No NPP found for NPObject!");
return JS_FALSE;
}
PluginDestructionGuard pdg(npp);
PRBool hasProperty = npobj->_class->hasProperty(npobj, (NPIdentifier)id);
PRBool hasMethod = npobj->_class->hasMethod(npobj, (NPIdentifier)id);
NPP npp = nsnull;
if (hasProperty) {
// Find out what plugin (NPP) is the owner of the object we're
// manipulating, and make it own any JSObject wrappers created
// here.
npp = LookupNPP(npobj);
if (!npp) {
ThrowJSException(cx, "No NPP found for NPObject!");
return JS_FALSE;
}
}
// To support ambiguous members, we return NPObject Member class here.
if (hasProperty && hasMethod)
@@ -1318,6 +1323,8 @@ CallNPMethodInternal(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
return JS_FALSE;
}
PluginDestructionGuard pdg(npp);
NPVariant npargs_buf[8];
NPVariant *npargs = npargs_buf;
@@ -1445,6 +1452,8 @@ NPObjWrapper_newEnumerate(JSContext *cx, JSObject *obj, JSIterateOp enum_op,
return JS_FALSE;
}
PluginDestructionGuard pdg(LookupNPP(npobj));
NS_ASSERTION(statep, "Must have a statep to enumerate!");
switch(enum_op) {
@@ -1515,6 +1524,8 @@ NPObjWrapper_NewResolve(JSContext *cx, JSObject *obj, jsval id, uintN flags,
return JS_FALSE;
}
PluginDestructionGuard pdg(LookupNPP(npobj));
if (npobj->_class->hasProperty(npobj, (NPIdentifier)id)) {
JSBool ok;