PR820: IcedTea-Web 1.1.3 crashing Firefox when loading Citrix XenApp

Patch from Thomas Meyer (primary) and Deepak Bhole

1 files changed, 14 insertions, 4 deletions

diff --git a/plugin/icedteanp/IcedTeaJavaRequestProcessor.cc b/plugin/icedteanp/IcedTeaJavaRequestProcessor.cc
index 5520206..675934c 100644
--- a/plugin/icedteanp/IcedTeaJavaRequestProcessor.cc
+++ b/plugin/icedteanp/IcedTeaJavaRequestProcessor.cc
@@ -921,6 +921,7 @@ createJavaObjectFromVariant(NPP instance, NPVariant variant, std::string* id)
         {
             PLUGIN_DEBUG("NPObject is not a Java object\n");
             NPIdentifier length_id = browser_functions.getstringidentifier("length");
+            bool isJSObjectArray = false;
 
             // FIXME: We currently only handle <= 2 dim arrays. Do we really need more though?
 
@@ -936,7 +937,7 @@ createJavaObjectFromVariant(NPP instance, NPVariant variant, std::string* id)
                 std::string length_str = std::string();
                 IcedTeaPluginUtilities::itoa(NPVARIANT_TO_INT32(length), &length_str);
 
-                if (NPVARIANT_TO_INT32(length) > 0)
+                if (NPVARIANT_TO_INT32(length) >= 0)
                 {
                     NPIdentifier id_0 = browser_functions.getintidentifier(0);
                     NPVariant first_element = NPVariant();
@@ -956,8 +957,14 @@ createJavaObjectFromVariant(NPP instance, NPVariant variant, std::string* id)
                     {
                         getArrayTypeForJava(instance, first_element, &java_array_type);
                     }
-                } else
-                    java_array_type.append("jsobject");
+                }
+
+                // For JSObject arrays, we create a regular object (accessible via JSObject.getSlot())
+                if (NPVARIANT_TO_INT32(length) < 0 || !java_array_type.compare("jsobject"))
+                {
+                    isJSObjectArray = true;
+                    goto createRegularObject;
+                }
 
                 java_result = java_request.newArray(java_array_type, length_str);
 
@@ -995,7 +1002,10 @@ createJavaObjectFromVariant(NPP instance, NPVariant variant, std::string* id)
 
                 // Got here => no errors above. We're good to return!
                 return;
-            } else // Else it is not an array
+            }
+
+            createRegularObject:
+            if (!IcedTeaPluginUtilities::isObjectJSArray(instance, obj) || isJSObjectArray) // Else it is not an array
             {
 
                 NPVariant* variant_copy = new NPVariant();