Bug 718293 - Anchor string in nsHTMLDocumentSH::CallToGetPropMapper. r=jorendorff
☠☠ backed out by b30bd7055fcb ☠ ☠
authorJames Kitchener <jkitch.bug@gmail.com>
Thu, 27 Sep 2012 23:05:58 -0400
changeset 108469 93b39d0f7d175aac17861bb33a5ac7b2119534b1
parent 108468 74493ca34d5ec9afe6680e9dbdc4c3d027857376
child 108470 b24a73b2c617f96be7a160642510750f87b8607a
push id82
push usershu@rfrn.org
push dateFri, 05 Oct 2012 13:20:22 +0000
reviewersjorendorff
bugs718293
milestone18.0a1
Bug 718293 - Anchor string in nsHTMLDocumentSH::CallToGetPropMapper. r=jorendorff
dom/base/nsDOMClassInfo.cpp
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -9168,16 +9168,17 @@ nsHTMLDocumentSH::CallToGetPropMapper(JS
     self = JSVAL_TO_OBJECT(JS_CALLEE(cx, vp));
   } else {
     self = JS_THIS_OBJECT(cx, vp);
     if (!self)
       return JS_FALSE;
   }
 
   size_t length;
+  JS::Anchor<JSString *> anchor(str)
   const jschar *chars = ::JS_GetStringCharsAndLength(cx, str, &length);
   if (!chars) {
     return JS_FALSE;
   }
 
   return ::JS_GetUCProperty(cx, self, chars, length, vp);
 }