Bug 592737 - vertexAttrib3fv crash [@JSObject::getClass] - r=vladimir, a=blocking2.0
authorBenoit Jacob <bjacob@mozilla.com>
Thu, 02 Sep 2010 10:46:51 -0400
changeset 51900 886665dec3cb627b8e8c3bd1efafdab32eb573be
parent 51899 f8e652b45a26b50356ad540a8dbba188aa307dae
child 51901 01cbf9182f77e2b5e470743441c47c6c14bdb938
push idunknown
push userunknown
push dateunknown
reviewersvladimir, blocking2.0
bugs592737
milestone2.0b6pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 592737 - vertexAttrib3fv crash [@JSObject::getClass] - r=vladimir, a=blocking2.0
content/canvas/src/CustomQS_WebGL.h
--- a/content/canvas/src/CustomQS_WebGL.h
+++ b/content/canvas/src/CustomQS_WebGL.h
@@ -527,17 +527,17 @@ helper_nsICanvasRenderingContextWebGL_Un
     nsIWebGLUniformLocation *location;
     xpc_qsSelfRef location_selfref;
     rv = xpc_qsUnwrapArg(cx, argv[0], &location, &location_selfref.ptr, &argv[0]);
     if (NS_FAILED(rv)) {
         xpc_qsThrowBadArg(cx, rv, vp, 0);
         return JS_FALSE;
     }
 
-    if (!JSVAL_IS_OBJECT(argv[1])) {
+    if (JSVAL_IS_PRIMITIVE(argv[1])) {
         xpc_qsThrowBadArg(cx, NS_ERROR_FAILURE, vp, 1);
         return JS_FALSE;
     }
 
     JSObject *arg1 = JSVAL_TO_OBJECT(argv[1]);
 
     js::AutoValueRooter obj_tvr(cx);
 
@@ -601,17 +601,17 @@ helper_nsICanvasRenderingContextWebGL_Un
     nsIWebGLUniformLocation *location;
     xpc_qsSelfRef location_selfref;
     rv = xpc_qsUnwrapArg(cx, argv[0], &location, &location_selfref.ptr, &argv[0]);
     if (NS_FAILED(rv)) {
         xpc_qsThrowBadArg(cx, rv, vp, 0);
         return JS_FALSE;
     }
 
-    if (!JSVAL_IS_OBJECT(argv[1])) {
+    if (JSVAL_IS_PRIMITIVE(argv[1])) {
         xpc_qsThrowBadArg(cx, NS_ERROR_FAILURE, vp, 1);
         return JS_FALSE;
     }
 
     JSObject *arg1 = JSVAL_TO_OBJECT(argv[1]);
 
     js::AutoValueRooter obj_tvr(cx);
 
@@ -679,17 +679,17 @@ helper_nsICanvasRenderingContextWebGL_Un
         xpc_qsThrowBadArg(cx, rv, vp, 0);
         return JS_FALSE;
     }
 
     int32 transpose;
     if (!JS_ValueToECMAInt32(cx, argv[1], &transpose))
         return JS_FALSE;
 
-    if (!JSVAL_IS_OBJECT(argv[2])) {
+    if (JSVAL_IS_PRIMITIVE(argv[2])) {
         xpc_qsThrowBadArg(cx, NS_ERROR_FAILURE, vp, 2);
         return JS_FALSE;
     }
 
     JSObject *arg2 = JSVAL_TO_OBJECT(argv[2]);
 
     js::AutoValueRooter obj_tvr(cx);
 
@@ -746,17 +746,17 @@ helper_nsICanvasRenderingContextWebGL_Ve
         return xpc_qsThrow(cx, NS_ERROR_XPC_NOT_ENOUGH_ARGS);
 
     jsval *argv = JS_ARGV(cx, vp);
 
     uint32 location;
     if (!JS_ValueToECMAUint32(cx, argv[0], &location))
         return JS_FALSE;
 
-    if (!JSVAL_IS_OBJECT(argv[1])) {
+    if (JSVAL_IS_PRIMITIVE(argv[1])) {
         xpc_qsThrowBadArg(cx, NS_ERROR_FAILURE, vp, 1);
         return JS_FALSE;
     }
 
     JSObject *arg1 = JSVAL_TO_OBJECT(argv[1]);
 
     js::AutoValueRooter obj_tvr(cx);
 
@@ -896,16 +896,21 @@ helper_nsICanvasRenderingContextWebGL_Un
     nsICanvasRenderingContextWebGL *self;
     xpc_qsSelfRef selfref;
     xpc_qsArgValArray<3> vp(cx);
     if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, &vp.array[0], nsnull)) {
         js_SetTraceableNativeFailed(cx);
         return;
     }
 
+    if (!arg) {
+        xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsICanvasRenderingContextWebGL", "uniformNiv");
+        js_SetTraceableNativeFailed(cx);
+    }
+
     js::AutoValueRooter obj_tvr(cx);
 
     nsIWebGLUniformLocation *location;
     xpc_qsSelfRef location_selfref;
     nsresult rv_convert_arg0
         = xpc_qsUnwrapThis(cx, locationobj, nsnull, &location, &location_selfref.ptr, &vp.array[1], nsnull);
     if (NS_FAILED(rv_convert_arg0)) {
         js_SetTraceableNativeFailed(cx);
@@ -959,16 +964,21 @@ helper_nsICanvasRenderingContextWebGL_Un
     nsICanvasRenderingContextWebGL *self;
     xpc_qsSelfRef selfref;
     xpc_qsArgValArray<3> vp(cx);
     if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, &vp.array[0], nsnull)) {
         js_SetTraceableNativeFailed(cx);
         return;
     }
 
+    if (!arg) {
+        xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsICanvasRenderingContextWebGL", "uniformNfv");
+        js_SetTraceableNativeFailed(cx);
+    }
+
     js::AutoValueRooter obj_tvr(cx);
 
     nsIWebGLUniformLocation *location;
     xpc_qsSelfRef location_selfref;
     nsresult rv_convert_arg0
         = xpc_qsUnwrapThis(cx, locationobj, nsnull, &location, &location_selfref.ptr, &vp.array[1], nsnull);
     if (NS_FAILED(rv_convert_arg0)) {
         js_SetTraceableNativeFailed(cx);
@@ -1024,16 +1034,21 @@ helper_nsICanvasRenderingContextWebGL_Un
     nsICanvasRenderingContextWebGL *self;
     xpc_qsSelfRef selfref;
     xpc_qsArgValArray<4> vp(cx);
     if (!xpc_qsUnwrapThis(cx, obj, nsnull, &self, &selfref.ptr, &vp.array[0], nsnull)) {
         js_SetTraceableNativeFailed(cx);
         return;
     }
 
+    if (!arg) {
+        xpc_qsThrowMethodFailedWithDetails(cx, NS_ERROR_FAILURE, "nsICanvasRenderingContextWebGL", "uniformMatrixNfv");
+        js_SetTraceableNativeFailed(cx);
+    }
+
     js::AutoValueRooter obj_tvr(cx);
 
     nsIWebGLUniformLocation *location;
     xpc_qsSelfRef location_selfref;
     nsresult rv_convert_arg0
         = xpc_qsUnwrapThis(cx, locationobj, nsnull, &location, &location_selfref.ptr, &vp.array[1], nsnull);
     if (NS_FAILED(rv_convert_arg0)) {
         js_SetTraceableNativeFailed(cx);