mirror of
https://github.com/servo/servo.git
synced 2025-07-22 23:03:42 +01:00
Fix crash when setting custom property on Location (#36494)
The JS engine uses types like `Handle<Maybe<PropertyDescriptor>>` in various places and our automated bindings are not able to handle the Maybe type. We have hand-written bindings that use outparams to indicate a PropertyDescriptor value is actually the Nothing type, but that data was getting lost when we passed the property descriptor to SetPropertyIgnoringNamedGetter, which assumed that the property descriptor was always valid. Depends on https://github.com/servo/mozjs/pull/579. Testing: Manual testing on testcase from https://github.com/servo/servo/issues/34709, and new crashtest added. Fixes: #34709 Signed-off-by: Josh Matthews <josh@joshmatthews.net>
This commit is contained in:
parent
f5e6eb289a
commit
9aa09d73b5
7 changed files with 21 additions and 13 deletions
|
@ -565,13 +565,18 @@ pub(crate) unsafe extern "C" fn maybe_cross_origin_set_rawcx<D: DomTypes>(
|
|||
return false;
|
||||
}
|
||||
|
||||
let own_desc_handle = own_desc.handle().into();
|
||||
js::jsapi::SetPropertyIgnoringNamedGetter(
|
||||
*cx,
|
||||
proxy,
|
||||
id,
|
||||
v,
|
||||
receiver,
|
||||
own_desc.handle().into(),
|
||||
if is_none {
|
||||
ptr::null()
|
||||
} else {
|
||||
&own_desc_handle
|
||||
},
|
||||
result,
|
||||
)
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue