Bug 1413815 - Don't try to convert a non-string JS::Value to string; r?smaug draft
authorEdgar Chen <echen@mozilla.com>
Fri, 03 Nov 2017 10:50:05 +0800
changeset 692419 e74608bfb58b97905f355b1266658d7c6ad825b0
parent 689820 ee21e5f7f1c1726e0ed2697eb45df54cdceedd36
child 738754 2bc0c07512759fd340c41e0ead6d00482acba420
push id87496
push userechen@mozilla.com
push dateFri, 03 Nov 2017 03:31:53 +0000
reviewerssmaug
bugs1413815
milestone58.0a1
Bug 1413815 - Don't try to convert a non-string JS::Value to string; r?smaug MozReview-Commit-ID: 1AYK5RF5GNc
dom/base/CustomElementRegistry.cpp
dom/base/crashtests/1413815.html
dom/base/crashtests/crashtests.list
--- a/dom/base/CustomElementRegistry.cpp
+++ b/dom/base/CustomElementRegistry.cpp
@@ -807,23 +807,25 @@ CustomElementRegistry::Define(const nsAS
             if (!iter.next(&attribute, &done)) {
               aRv.StealExceptionFromJSContext(cx);
               return;
             }
             if (done) {
               break;
             }
 
-            JSString *attrJSStr = attribute.toString();
-            nsAutoJSString attrStr;
-            if (!attrStr.init(cx, attrJSStr)) {
-              aRv.StealExceptionFromJSContext(cx);
-              return;
+            if (attribute.isString()) {
+              JSString *attrJSStr = attribute.toString();
+              nsAutoJSString attrStr;
+              if (!attrStr.init(cx, attrJSStr)) {
+                aRv.StealExceptionFromJSContext(cx);
+                return;
+              }
+              observedAttributes.AppendElement(NS_Atomize(attrStr));
             }
-            observedAttributes.AppendElement(NS_Atomize(attrStr));
           }
         }
       } // Leave constructor's compartment.
     } // Leave constructorProtoUnwrapped's compartment.
   } // Unset mIsCustomDefinitionRunning
 
   /**
    * 11. Let definition be a new custom element definition with name name,
new file mode 100644
--- /dev/null
+++ b/dom/base/crashtests/1413815.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script type="text/javascript">
+class XFoo extends HTMLElement {
+  constructor() {
+    super();
+  }
+
+  static get observedAttributes() {
+    return [3.76277868767527e-310, Symbol("Ashitaka"), {}];
+  }
+
+  attributeChangedCallback(aName, aOldValue, aNewValue) {
+  }
+}
+
+customElements.define('x-foo', XFoo);
+</script>
+</html>
--- a/dom/base/crashtests/crashtests.list
+++ b/dom/base/crashtests/crashtests.list
@@ -229,8 +229,9 @@ load 1383780.html
 pref(clipboard.autocopy,true) load 1385272-1.html
 load 1393806.html
 load 1396466.html
 load 1400701.html
 load 1403377.html
 load 1405771.html
 load 1406109-1.html
 pref(dom.webcomponents.enabled,true) load 1324463.html
+pref(dom.webcomponents.customelements.enabled,true) load 1413815.html