Bug 1437476 - Clone annotation objects before passing to back-end services to avoid leaks. r?mak draft
authorMark Banner <standard8@mozilla.com>
Wed, 28 Feb 2018 15:59:06 +0000
changeset 761044 91371355dddc3f28166ebdfa8313b67c8ad1de41
parent 760935 ee326c976eebdca48128054022c443d3993e12b0
child 761045 52f981f535a8c82a99d39d78bba333d5cc9efd0f
push id100832
push userbmo:standard8@mozilla.com
push dateWed, 28 Feb 2018 16:01:28 +0000
reviewersmak
bugs1437476
milestone60.0a1
Bug 1437476 - Clone annotation objects before passing to back-end services to avoid leaks. r?mak MozReview-Commit-ID: 1ke3FK4gQkL
toolkit/components/places/PlacesTransactions.jsm
--- a/toolkit/components/places/PlacesTransactions.jsm
+++ b/toolkit/components/places/PlacesTransactions.jsm
@@ -732,18 +732,21 @@ function checkProperty(obj, prop, requir
 DefineTransaction.annotationObjectValidate = function(obj) {
   if (obj &&
       checkProperty(obj, "name", true, v => typeof(v) == "string" && v.length > 0) &&
       checkProperty(obj, "expires", false, Number.isInteger) &&
       checkProperty(obj, "flags", false, Number.isInteger) &&
       checkProperty(obj, "value", false, isPrimitive) ) {
     // Nothing else should be set
     let validKeys = ["name", "value", "flags", "expires"];
-    if (Object.keys(obj).every(k => validKeys.includes(k)))
-      return obj;
+    if (Object.keys(obj).every(k => validKeys.includes(k))) {
+      // Annotations objects are passed through to the backend, to avoid memory
+      // leaks, we must clone the object.
+      return {...obj};
+    }
   }
   throw new Error("Invalid annotation object");
 };
 
 DefineTransaction.childObjectValidate = function(obj) {
   if (obj &&
       checkProperty(obj, "title", false, v => typeof(v) == "string") &&
       !("type" in obj && obj.type != PlacesUtils.bookmarks.TYPE_BOOKMARK)) {