summary refs log tree commit diff
path: root/gnu/packages/patches/icecat-CVE-2016-1966.patch
blob: 6bf5f9f95e65335e49e364ed6f8f5f23caa3c186 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
Copied from upstream:
https://hg.mozilla.org/releases/mozilla-esr38/raw-rev/291c2f31c48c

# HG changeset patch
# User Nicholas Nethercote <nnethercote@mozilla.com>
# Date 1454650565 -39600
# Node ID 291c2f31c48c7e96b1884b55273355970fa0fc30
# Parent  11e6614756551cfd7291e73eefb90c52873a8480
Bug 1246054 - Fix an erroneous nsNPObjWrapper assertion. r=froydnj. a=ritu

diff --git a/dom/plugins/base/nsJSNPRuntime.cpp b/dom/plugins/base/nsJSNPRuntime.cpp
--- a/dom/plugins/base/nsJSNPRuntime.cpp
+++ b/dom/plugins/base/nsJSNPRuntime.cpp
@@ -1915,18 +1915,19 @@ nsNPObjWrapper::GetNewOrUsed(NPP npp, JS
   // No existing JSObject, create one.
 
   JS::Rooted<JSObject*> obj(cx, ::JS_NewObject(cx, js::Jsvalify(&sNPObjectJSWrapperClass)));
 
   if (generation != sNPObjWrappers.Generation()) {
       // Reload entry if the JS_NewObject call caused a GC and reallocated
       // the table (see bug 445229). This is guaranteed to succeed.
 
-      NS_ASSERTION(PL_DHashTableSearch(&sNPObjWrappers, npobj),
-                   "Hashtable didn't find what we just added?");
+      entry = static_cast<NPObjWrapperHashEntry*>
+        (PL_DHashTableSearch(&sNPObjWrappers, npobj));
+      NS_ASSERTION(entry, "Hashtable didn't find what we just added?");
   }
 
   if (!obj) {
     // OOM? Remove the stale entry from the hash.
 
     PL_DHashTableRawRemove(&sNPObjWrappers, entry);
 
     return nullptr;