Bug 375457 - "toDataURL has incorrect type-checking logic" [p=joe@drew.ca (Joe Drew [JOEDREW!]) r+a1.9=vlad]
authorreed@reedloden.com
Sun, 16 Mar 2008 14:02:05 -0700
changeset 13145 73ae680263103a433b0ca78f3b1dc861435c69a9
parent 13144 bf1e867422cf43e36ec352b377861f1ab9452d4b
child 13146 a6cf60a4945d184510c61b99b5fd8620d0c27b17
push idunknown
push userunknown
push dateunknown
bugs375457
milestone1.9b5pre
Bug 375457 - "toDataURL has incorrect type-checking logic" [p=joe@drew.ca (Joe Drew [JOEDREW!]) r+a1.9=vlad]
content/html/content/src/nsHTMLCanvasElement.cpp
--- a/content/html/content/src/nsHTMLCanvasElement.cpp
+++ b/content/html/content/src/nsHTMLCanvasElement.cpp
@@ -325,17 +325,17 @@ nsHTMLCanvasElement::ToDataURL(nsAString
       return NS_ERROR_DOM_SYNTAX_ERR;
     JSString *type = JS_ValueToString(ctx, argv[0]);
     return ToDataURLImpl (nsDependentString(reinterpret_cast<PRUnichar*>((JS_GetStringChars(type)))),
                           EmptyString(), aDataURL);
   }
 
   // 2-arg case; trusted only (checked above), convert to mime type with params
   if (argc == 2) {
-    if (!JSVAL_IS_STRING(argv[0]) && !JSVAL_IS_STRING(argv[1]))
+    if (!JSVAL_IS_STRING(argv[0]) || !JSVAL_IS_STRING(argv[1]))
       return NS_ERROR_DOM_SYNTAX_ERR;
 
     JSString *type, *params;
     type = JS_ValueToString(ctx, argv[0]);
     params = JS_ValueToString(ctx, argv[1]);
 
     return ToDataURLImpl (nsDependentString(reinterpret_cast<PRUnichar*>(JS_GetStringChars(type))),
                           nsDependentString(reinterpret_cast<PRUnichar*>(JS_GetStringChars(params))),