From f1ab9ff32e5b6236f94feb96262c796690aa4f9a Mon Sep 17 00:00:00 2001 From: "mrbkap%gmail.com" Date: Wed, 25 Jan 2006 02:27:59 +0000 Subject: [PATCH] bug 324422: Protect things from being garbage collected out from under us. r=brendan git-svn-id: svn://10.0.0.236/trunk@188134 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/js/src/jsxml.c | 37 +++++++++++++++---------------------- 1 file changed, 15 insertions(+), 22 deletions(-) diff --git a/mozilla/js/src/jsxml.c b/mozilla/js/src/jsxml.c index c9e66c21482..8a0ca723644 100644 --- a/mozilla/js/src/jsxml.c +++ b/mozilla/js/src/jsxml.c @@ -1225,7 +1225,12 @@ XMLArrayTruncate(JSContext *cx, JSXMLArray *array, uint32 length) #define XMLARRAY_HAS_MEMBER(a,e,f) (XMLArrayFindMember(a, (void *)(e), f) != \ XML_NOT_FOUND) #define XMLARRAY_MEMBER(a,i,t) ((t *) (a)->vector[i]) -#define XMLARRAY_SET_MEMBER(a,i,e) ((a)->vector[i] = (void *)(e)) +#define XMLARRAY_SET_MEMBER(a,i,e) \ + JS_BEGIN_MACRO \ + if ((a)->length <= (i)) \ + (a)->length = (i) + 1; \ + ((a)->vector[i] = (void *)(e)); \ + JS_END_MACRO #define XMLARRAY_ADD_MEMBER(x,a,i,e)XMLArrayAddMember(x, a, i, (void *)(e)) #define XMLARRAY_INSERT(x,a,i,n) XMLArrayInsert(x, a, i, n) #define XMLARRAY_APPEND(x,a,e) XMLARRAY_ADD_MEMBER(x, a, (a)->length, (e)) @@ -1483,8 +1488,10 @@ ParseNodeToXML(JSContext *cx, JSParseNode *pn, JSXMLArray *inScopeNSes, xml = ParseNodeToXML(cx, pn2, inScopeNSes, flags); if (!xml) goto fail; - flags &= ~XSF_PRECOMPILED_ROOT; + if (js_PushLocalRoot(cx, cx->localRootStack, (jsval)xml) < 0) + goto fail; + flags &= ~XSF_PRECOMPILED_ROOT; n = pn->pn_count; JS_ASSERT(n >= 2); n -= 2; @@ -1511,10 +1518,8 @@ ParseNodeToXML(JSContext *cx, JSParseNode *pn, JSXMLArray *inScopeNSes, continue; } - if (!kid) { - xml->xml_kids.length = i; + if (!kid) goto fail; - } /* Store kid in xml right away, to protect it from GC. */ XMLARRAY_SET_MEMBER(&xml->xml_kids, i, kid); @@ -1532,7 +1537,6 @@ ParseNodeToXML(JSContext *cx, JSParseNode *pn, JSXMLArray *inScopeNSes, } JS_ASSERT(i == n); - xml->xml_kids.length = n; if (n < pn->pn_count - 2) XMLArrayTrim(&xml->xml_kids); XMLARRAY_TRUNCATE(cx, inScopeNSes, length); @@ -1565,16 +1569,13 @@ ParseNodeToXML(JSContext *cx, JSParseNode *pn, JSXMLArray *inScopeNSes, continue; } - if (!kid) { - xml->xml_kids.length = i; + if (!kid) goto fail; - } XMLARRAY_SET_MEMBER(&xml->xml_kids, i, kid); ++i; } - xml->xml_kids.length = n; if (n < pn->pn_count) XMLArrayTrim(&xml->xml_kids); break; @@ -1583,7 +1584,7 @@ ParseNodeToXML(JSContext *cx, JSParseNode *pn, JSXMLArray *inScopeNSes, case TOK_XMLPTAGC: length = inScopeNSes->length; pn2 = pn->pn_head; - JS_ASSERT(pn2->pn_type = TOK_XMLNAME); + JS_ASSERT(pn2->pn_type == TOK_XMLNAME); if (pn2->pn_arity == PN_LIST) goto syntax; @@ -1732,10 +1733,8 @@ ParseNodeToXML(JSContext *cx, JSParseNode *pn, JSXMLArray *inScopeNSes, JS_ASSERT(pn2->pn_type == TOK_XMLATTR); attr = js_NewXML(cx, JSXML_CLASS_ATTRIBUTE); - if (!attr) { - xml->xml_attrs.length = i; + if (!attr) goto fail; - } XMLARRAY_SET_MEMBER(&xml->xml_attrs, i, attr); attr->parent = xml; @@ -1743,8 +1742,6 @@ ParseNodeToXML(JSContext *cx, JSParseNode *pn, JSXMLArray *inScopeNSes, attr->xml_value = ATOM_TO_STRING(pn2->pn_atom); } - xml->xml_attrs.length = n; - /* Point tag closes its own namespace scope. */ if (pn->pn_type == TOK_XMLPTAGC) XMLARRAY_TRUNCATE(cx, inScopeNSes, length); @@ -3147,7 +3144,6 @@ Append(JSContext *cx, JSXML *list, JSXML *xml) kid = XMLARRAY_MEMBER(&xml->xml_kids, j, JSXML); XMLARRAY_SET_MEMBER(&list->xml_kids, i + j, kid); } - list->xml_kids.length = k; return JS_TRUE; } @@ -3240,12 +3236,12 @@ DeepCopySetInLRS(JSContext *cx, JSXMLArray *from, JSXMLArray *to, JSXML *parent, kid2->xml_value = str; } - XMLARRAY_SET_MEMBER(to, j++, kid2); + XMLARRAY_SET_MEMBER(to, j, kid2); + ++j; if (parent->xml_class != JSXML_CLASS_LIST) kid2->parent = parent; } - to->length = j; if (j < n) XMLArrayTrim(to); return JS_TRUE; @@ -3303,7 +3299,6 @@ DeepCopyInLRS(JSContext *cx, JSXML *xml, uintN flags) } XMLARRAY_SET_MEMBER(©->xml_namespaces, i, ns2); } - copy->xml_namespaces.length = n; ok = DeepCopySetInLRS(cx, &xml->xml_attrs, ©->xml_attrs, copy, 0); @@ -4324,7 +4319,6 @@ PutProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp) kid2 = XMLARRAY_MEMBER(&vxml->xml_kids, k, JSXML); XMLARRAY_SET_MEMBER(©->xml_kids, k, kid2); } - copy->xml_kids.length = n; JS_ASSERT(parent != xml); if (parent) { @@ -6113,7 +6107,6 @@ xml_namespace(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, XMLARRAY_SET_MEMBER(&inScopeNSes, i, ns); } - inScopeNSes.length = i; ns = ok ? GetNamespace(cx, xml->name, &inScopeNSes) : NULL; XMLArrayFinish(cx, &inScopeNSes); if (!ns)