diff options
| author | tsepez <tsepez@chromium.org> | 2016-06-09 09:32:44 -0700 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2016-06-09 09:32:44 -0700 |
| commit | 2334e9e583799a8cb2dfefb3c7e15c5a7da8ead0 (patch) | |
| tree | bf0391385c463d722a8896e1367df40940fdf8cf /xfa/fxjse/class.cpp | |
| parent | 9e077d288016ac796fef18c27cd0851c0a07ff86 (diff) | |
| download | pdfium-2334e9e583799a8cb2dfefb3c7e15c5a7da8ead0.tar.xz | |
Fix crash in CXFA_Node::TryUserData() (speculative)
Fix is speculative because I can't repro locally, but I know the
current code is wrong.
I fixed this intially in https://codereview.chromium.org/2015143005/
I then broke it again in https://codereview.chromium.org/2019333006/
There is another spot where we are still casting through void*, and
the CXFA_Node*'s alignment is getting messed up when it fails to adjust
for it's vtable. Using CFXJSE_HostObject consistently avoids the issue.
Adding a virtual dtor to CFXJSE_HostObject might skirt the issue, but
I want to be able to wrap simple objects without that penalty if
desired.
BUG=616339
Review-Url: https://codereview.chromium.org/2055473004
Diffstat (limited to 'xfa/fxjse/class.cpp')
| -rw-r--r-- | xfa/fxjse/class.cpp | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/xfa/fxjse/class.cpp b/xfa/fxjse/class.cpp index bd589453f2..e9d67d8cda 100644 --- a/xfa/fxjse/class.cpp +++ b/xfa/fxjse/class.cpp @@ -147,7 +147,8 @@ CFX_ByteString CFXJSE_Arguments::GetUTF8String(int32_t index) const { return CFX_ByteString(*szStringVal); } -void* CFXJSE_Arguments::GetObject(int32_t index, CFXJSE_Class* pClass) const { +CFXJSE_HostObject* CFXJSE_Arguments::GetObject(int32_t index, + CFXJSE_Class* pClass) const { v8::Local<v8::Value> hValue = (*m_pInfo)[index]; ASSERT(!hValue.IsEmpty()); if (!hValue->IsObject()) |