diff options
| author | Tom Sepez <tsepez@chromium.org> | 2017-06-01 14:59:33 -0700 |
|---|---|---|
| committer | Chromium commit bot <commit-bot@chromium.org> | 2017-06-01 22:53:07 +0000 |
| commit | 8cb884102c17ef0530277126fd8da054d329d065 (patch) | |
| tree | c1261704e61637b69115d488406e252fb668097a /xfa/fxfa/parser/cxfa_scriptcontext.cpp | |
| parent | 5171a27eaa7489939310bd2864864867cc78ce21 (diff) | |
| download | pdfium-8cb884102c17ef0530277126fd8da054d329d065.tar.xz | |
Tag CFXJSE_HostObject sub-classes.
CXFA_FM2JSContext and CXFA_Object both subclass CFXJSE_HostObject.
When a CFXJSE_HostObject is obtained from an opaque pointer inside
a V8 object internal slot, there is no way to distinguish one from
the other.
Bug: 728158
Change-Id: Iabc648e8b7226e2819d8795227442c3f6c61a793
Reviewed-on: https://pdfium-review.googlesource.com/6211
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Diffstat (limited to 'xfa/fxfa/parser/cxfa_scriptcontext.cpp')
| -rw-r--r-- | xfa/fxfa/parser/cxfa_scriptcontext.cpp | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/xfa/fxfa/parser/cxfa_scriptcontext.cpp b/xfa/fxfa/parser/cxfa_scriptcontext.cpp index 2100299616..fcf22442f1 100644 --- a/xfa/fxfa/parser/cxfa_scriptcontext.cpp +++ b/xfa/fxfa/parser/cxfa_scriptcontext.cpp @@ -115,7 +115,10 @@ const XFA_METHODINFO* GetMethodByName(XFA_Element eElement, // static. CXFA_Object* CXFA_ScriptContext::ToObject(CFXJSE_Value* pValue, CFXJSE_Class* pClass) { - return static_cast<CXFA_Object*>(pValue->ToHostObject(pClass)); + CFXJSE_HostObject* pHostObj = pValue->ToHostObject(pClass); + if (!pHostObj || pHostObj->type() != CFXJSE_HostObject::kXFA) + return nullptr; + return static_cast<CXFA_Object*>(pHostObj); } CXFA_ScriptContext::CXFA_ScriptContext(CXFA_Document* pDocument) |