Bug 989665 - Console API should clone objects propertly. Crash fixed, r=bz
authorAndrea Marchesini <amarchesini@mozilla.com>
Wed, 02 Apr 2014 10:09:29 +0100
changeset 177014 61b1f28c3c16e2fd3a9850327713e7fbf5e859b5
parent 177013 53faa7fe92a686518d584f23c5c4f45d50f71c6b
child 177015 0a245ee13ce61dc773966d94fe1b6f3b08992d18
child 177077 80dcb8e4696453ac52e11cd711c06be3e91ca492
push id272
push userpvanderbeken@mozilla.com
push dateMon, 05 May 2014 16:31:18 +0000
reviewersbz
bugs989665
milestone31.0a1
Bug 989665 - Console API should clone objects propertly. Crash fixed, r=bz
dom/base/Console.cpp
dom/base/test/mochitest.ini
dom/base/test/test_bug989665.html
--- a/dom/base/Console.cpp
+++ b/dom/base/Console.cpp
@@ -69,17 +69,17 @@ ConsoleStructuredCloneCallbacksRead(JSCo
 {
   AssertIsOnMainThread();
 
   if (aTag != CONSOLE_TAG) {
     return nullptr;
   }
 
   nsTArray<nsString>* strings = static_cast<nsTArray<nsString>*>(aClosure);
-  MOZ_ASSERT(strings->Length() <= aData);
+  MOZ_ASSERT(strings->Length() > aData);
 
   JS::Rooted<JS::Value> value(aCx);
   if (!xpc::StringToJsval(aCx, strings->ElementAt(aData), &value)) {
     return nullptr;
   }
 
   JS::Rooted<JSObject*> obj(aCx);
   if (!JS_ValueToObject(aCx, value, &obj)) {
--- a/dom/base/test/mochitest.ini
+++ b/dom/base/test/mochitest.ini
@@ -9,16 +9,17 @@ support-files =
 
 [test_Image_constructor.html]
 [test_appname_override.html]
 [test_audioWindowUtils.html]
 [test_audioNotification.html]
 [test_bug913761.html]
 [test_bug978522.html]
 [test_bug979109.html]
+[test_bug989665.html]
 [test_clearTimeoutIntervalNoArg.html]
 [test_consoleEmptyStack.html]
 [test_constructor-assignment.html]
 [test_constructor.html]
 [test_document.all_unqualified.html]
 [test_domcursor.html]
 [test_domrequest.html]
 [test_domwindowutils.html]
new file mode 100644
--- /dev/null
+++ b/dom/base/test/test_bug989665.html
@@ -0,0 +1,21 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=989665
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 989665</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=989665">Mozilla Bug 989665</a>
+<script type="application/javascript">
+
+w = new Worker("data:text/javascript;charset=UTF-8, console.log('%s', {toString: function() { throw 3 }}); ");
+ok(true, "This test should not crash.");
+
+</script>
+</body>
+</html>