#534: M1499861 M1500759 M1500310 M1507907

dom/crypto/WebCryptoTask.cpp

@@ -487,7 +487,7 @@ class AesTask : public ReturnArrayBufferViewTask,
 
       mMechanism = CKM_AES_CBC_PAD;
       telemetryAlg = TA_AES_CBC;
-      AesCbcParams params;
+      RootedDictionary<AesCbcParams> params(aCx);
       nsresult rv = Coerce(aCx, params, aAlgorithm);
       if (NS_FAILED(rv)) {
         mEarlyRv = NS_ERROR_DOM_INVALID_ACCESS_ERR;
@@ -504,7 +504,7 @@ class AesTask : public ReturnArrayBufferViewTask,
 
       mMechanism = CKM_AES_CTR;
       telemetryAlg = TA_AES_CTR;
-      AesCtrParams params;
+      RootedDictionary<AesCtrParams> params(aCx);
       nsresult rv = Coerce(aCx, params, aAlgorithm);
       if (NS_FAILED(rv)) {
         mEarlyRv = NS_ERROR_DOM_SYNTAX_ERR;
@@ -523,7 +523,7 @@ class AesTask : public ReturnArrayBufferViewTask,
 
       mMechanism = CKM_AES_GCM;
       telemetryAlg = TA_AES_GCM;
-      AesGcmParams params;
+      RootedDictionary<AesGcmParams> params(aCx);
       nsresult rv = Coerce(aCx, params, aAlgorithm);
       if (NS_FAILED(rv)) {
         mEarlyRv = NS_ERROR_DOM_SYNTAX_ERR;

dom/html/HTMLOptionsCollection.cpp

@@ -35,23 +35,8 @@ namespace mozilla {
 namespace dom {
 
 HTMLOptionsCollection::HTMLOptionsCollection(HTMLSelectElement* aSelect)
-{
-  // Do not maintain a reference counted reference. When
-  // the select goes away, it will let us know.
-  mSelect = aSelect;
-}
-
-HTMLOptionsCollection::~HTMLOptionsCollection()
-{
-  DropReference();
-}
-
-void
-HTMLOptionsCollection::DropReference()
-{
-  // Drop our (non ref-counted) reference
-  mSelect = nullptr;
-}
+  : mSelect(aSelect)
+{}
 
 nsresult
 HTMLOptionsCollection::GetOptionIndex(Element* aOption,
@@ -88,7 +73,9 @@ HTMLOptionsCollection::GetOptionIndex(Element* aOption,
 }
 
 
-NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(HTMLOptionsCollection, mElements)
+NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(HTMLOptionsCollection,
+                                      mElements,
+                                      mSelect)
 
 // nsISupports
 
@@ -124,21 +111,13 @@ HTMLOptionsCollection::GetLength(uint32_t* aLength)
 NS_IMETHODIMP
 HTMLOptionsCollection::SetLength(uint32_t aLength)
 {
-  if (!mSelect) {
-    return NS_ERROR_UNEXPECTED;
-  }
-
   return mSelect->SetLength(aLength);
 }
 
 NS_IMETHODIMP
 HTMLOptionsCollection::SetOption(uint32_t aIndex,
                                  nsIDOMHTMLOptionElement* aOption)
 {
-  if (!mSelect) {
-    return NS_OK;
-  }
-
   // if the new option is null, just remove this option.  Note that it's safe
   // to pass a too-large aIndex in here.
   if (!aOption) {
@@ -187,11 +166,6 @@ HTMLOptionsCollection::SetOption(uint32_t aIndex,
 int32_t
 HTMLOptionsCollection::GetSelectedIndex(ErrorResult& aError)
 {
-  if (!mSelect) {
-    aError.Throw(NS_ERROR_UNEXPECTED);
-    return 0;
-  }
-
   int32_t selectedIndex;
   aError = mSelect->GetSelectedIndex(&selectedIndex);
   return selectedIndex;
@@ -209,11 +183,6 @@ void
 HTMLOptionsCollection::SetSelectedIndex(int32_t aSelectedIndex,
                                         ErrorResult& aError)
 {
-  if (!mSelect) {
-    aError.Throw(NS_ERROR_UNEXPECTED);
-    return;
-  }
-
   aError = mSelect->SetSelectedIndex(aSelectedIndex);
 }
 
@@ -331,10 +300,6 @@ HTMLOptionsCollection::Add(nsIDOMHTMLOptionElement* aOption,
     return NS_ERROR_INVALID_ARG;
   }
 
-  if (!mSelect) {
-    return NS_ERROR_NOT_INITIALIZED;
-  }
-
   nsCOMPtr<nsIDOMHTMLElement> elem = do_QueryInterface(aOption);
   return mSelect->Add(elem, aBefore);
 }
@@ -344,22 +309,12 @@ HTMLOptionsCollection::Add(const HTMLOptionOrOptGroupElement& aElement,
                            const Nullable<HTMLElementOrLong>& aBefore,
                            ErrorResult& aError)
 {
-  if (!mSelect) {
-    aError.Throw(NS_ERROR_NOT_INITIALIZED);
-    return;
-  }
-
   mSelect->Add(aElement, aBefore, aError);
 }
 
 void
 HTMLOptionsCollection::Remove(int32_t aIndex, ErrorResult& aError)
 {
-  if (!mSelect) {
-    aError.Throw(NS_ERROR_UNEXPECTED);
-    return;
-  }
-
   uint32_t len = 0;
   mSelect->GetLength(&len);
   if (aIndex < 0 || (uint32_t)aIndex >= len)

dom/html/HTMLOptionsCollection.h

@@ -46,7 +46,7 @@ class HTMLOptionsCollection final : public nsIHTMLCollection
   using nsWrapperCache::GetWrapper;
   virtual JSObject* WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) override;
 protected:
-  virtual ~HTMLOptionsCollection();
+  virtual ~HTMLOptionsCollection() = default;
 
   virtual JSObject* GetWrapperPreserveColorInternal() override
   {
@@ -112,11 +112,6 @@ class HTMLOptionsCollection final : public nsIHTMLCollection
     mElements.AppendElement(aOption);
   }
 
-  /**
-   * Drop the reference to the select.  Called during select destruction.
-   */
-  void DropReference();
-
   /**
    * Finds the index of a given option element.
    * If the option isn't part of the collection, return NS_ERROR_FAILURE
@@ -162,7 +157,7 @@ class HTMLOptionsCollection final : public nsIHTMLCollection
    * various members such as InsertOptionAt are also infallible. */
   nsTArray<RefPtr<mozilla::dom::HTMLOptionElement> > mElements;
   /** The select element that contains this array */
-  HTMLSelectElement* mSelect;
+  RefPtr<HTMLSelectElement> mSelect;
 };
 
 } // namespace dom

dom/html/HTMLSelectElement.cpp

@@ -130,11 +130,6 @@ HTMLSelectElement::HTMLSelectElement(already_AddRefed<mozilla::dom::NodeInfo>& a
                     NS_EVENT_STATE_VALID);
 }
 
-HTMLSelectElement::~HTMLSelectElement()
-{
-  mOptions->DropReference();
-}
-
 // ISupports
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(HTMLSelectElement)

dom/html/HTMLSelectElement.h

@@ -431,7 +431,7 @@ class HTMLSelectElement final : public nsGenericHTMLFormElementWithState,
   }
 
 protected:
-  virtual ~HTMLSelectElement();
+  virtual ~HTMLSelectElement() = default;
 
   friend class SafeOptionListMutation;
 

dom/indexedDB/IDBObjectStore.cpp

@@ -1251,20 +1251,22 @@ IDBObjectStore::GetAddInfo(JSContext* aCx,
   }
 
   // Figure out indexes and the index values to update here.
-  const nsTArray<IndexMetadata>& indexes = mSpec->indexes();
+  {
+    const nsTArray<IndexMetadata>& indexes = mSpec->indexes();
+    uint32_t idxCount = indexes.Length();
 
-  const uint32_t idxCount = indexes.Length();
-  aUpdateInfoArray.SetCapacity(idxCount); // Pretty good estimate
+    aUpdateInfoArray.SetCapacity(idxCount); // Pretty good estimate
 
-  for (uint32_t idxIndex = 0; idxIndex < idxCount; idxIndex++) {
-    const IndexMetadata& metadata = indexes[idxIndex];
+    for (uint32_t idxIndex = 0; idxIndex < idxCount; idxIndex++) {
+      const IndexMetadata& metadata = indexes[idxIndex];
 
-    rv = AppendIndexUpdateInfo(metadata.id(), metadata.keyPath(),
-                               metadata.unique(), metadata.multiEntry(),
-                               metadata.locale(), aCx, aValue,
-                               aUpdateInfoArray);
-    if (NS_WARN_IF(NS_FAILED(rv))) {
-      return rv;
+      rv = AppendIndexUpdateInfo(metadata.id(), metadata.keyPath(),
+                                 metadata.unique(), metadata.multiEntry(),
+                                 metadata.locale(), aCx, aValue,
+                                 aUpdateInfoArray);
+      if (NS_WARN_IF(NS_FAILED(rv))) {
+        return rv;
+      }
     }
   }
 
@@ -1322,6 +1324,11 @@ IDBObjectStore::AddOrPut(JSContext* aCx,
     return nullptr;
   }
 
+  if (!mTransaction->IsOpen()) {
+    aRv.Throw(NS_ERROR_DOM_INDEXEDDB_TRANSACTION_INACTIVE_ERR);
+    return nullptr;
+  }
+
   FallibleTArray<uint8_t> cloneData;
   if (NS_WARN_IF(!cloneData.SetLength(cloneWriteInfo.mCloneBuffer.nbytes(),
                                       fallible))) {

intl/locale/mac/nsDateTimeFormatMac.cpp

@@ -164,6 +164,8 @@ nsresult nsDateTimeFormatMac::FormatTMTime(nsILocale* locale,
   // Create the formatter and fix up its formatting as necessary:
   CFDateFormatterRef formatter =
     CFDateFormatterCreate(nullptr, formatterLocale, dateStyle, timeStyle);
+  if (MOZ_UNLIKELY(!formatter))
+    return NS_ERROR_FAILURE; // don't continue
 
   CFRelease(formatterLocale);