From b8ed7591ccac6263013f111e5cc06bccf181061d Mon Sep 17 00:00:00 2001 From: "timeless%mozdev.org" Date: Mon, 21 Apr 2008 18:57:14 +0000 Subject: [PATCH] Bug 382631 Creating proxy of "this" in JavaScript using nsProxyObjectManager::GetProxyForObject causes random memory rewrite r=dougt a=beltzner git-svn-id: svn://10.0.0.236/trunk@250571 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/xpcom/proxy/src/nsProxyEventObject.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mozilla/xpcom/proxy/src/nsProxyEventObject.cpp b/mozilla/xpcom/proxy/src/nsProxyEventObject.cpp index 892617d2335..7dab1773c80 100644 --- a/mozilla/xpcom/proxy/src/nsProxyEventObject.cpp +++ b/mozilla/xpcom/proxy/src/nsProxyEventObject.cpp @@ -154,7 +154,8 @@ nsProxyEventObject::convertMiniVariantToVariant(const XPTMethodDescriptor *metho for (int i = 0; i < paramCount; i++) { const nsXPTParamInfo& paramInfo = methodInfo->params[i]; - if ((GetProxyType() & NS_PROXY_ASYNC) && paramInfo.IsDipper()) + if ((GetProxyType() & NS_PROXY_ASYNC) && + (paramInfo.IsOut() || paramInfo.IsDipper())) { NS_WARNING("Async proxying of out parameters is not supported"); free(*fullParam);