Bug 1299363 - Part 2: Allow prototype swizzling in html constructor.

Tag UXP Issue #1344
This commit is contained in:
Gaming4JC 2020-01-05 10:28:42 -05:00 committed by Roy Tam
commit a35a4e8f12
3 changed files with 20 additions and 4 deletions

View file

@ -3431,7 +3431,7 @@ GetCustomElementReactionsStack(JS::Handle<JSObject*> aObj)
// https://html.spec.whatwg.org/multipage/dom.html#htmlconstructor
already_AddRefed<nsGenericHTMLElement>
CreateHTMLElement(const GlobalObject& aGlobal, const JS::CallArgs& aCallArgs,
ErrorResult& aRv)
JS::Handle<JSObject*> aGivenProto, ErrorResult& aRv)
{
// Step 1.
nsCOMPtr<nsPIDOMWindowInner> window = do_QueryInterface(aGlobal.GetAsSupports());
@ -3566,7 +3566,23 @@ CreateHTMLElement(const GlobalObject& aGlobal, const JS::CallArgs& aCallArgs,
return nullptr;
}
// Step 11 is in the code output by CGClassConstructor.
// Step 11.
// Do prototype swizzling for upgrading a custom element here, for cases when
// we have a reflector already. If we don't have one yet, our caller will
// create it with the right proto (by calling DoGetOrCreateDOMReflector with
// that proto).
JS::Rooted<JSObject*> reflector(cx, element->GetWrapper());
if (reflector) {
// reflector might be in different compartment.
JSAutoCompartment ac(cx, reflector);
JS::Rooted<JSObject*> givenProto(cx, aGivenProto);
if (!JS_WrapObject(cx, &givenProto) ||
!JS_SetPrototype(cx, reflector, givenProto)) {
aRv.NoteJSContextException(cx);
return nullptr;
}
}
// Step 12 and Step 13.
return element.forget();
}