From 853897d5ca40e50aa94bc0eab8dc5b5ecd6f6507 Mon Sep 17 00:00:00 2001
From: Fedor <fedor@mail.ru>
Date: Wed, 10 Jun 2020 21:12:43 +0300
Subject: [PATCH] Bug 1632717.

---
 dom/media/eme/EMEUtils.cpp             | 12 ++++++++++++
 dom/media/eme/EMEUtils.h               |  5 +++++
 dom/media/eme/MediaEncryptedEvent.cpp  |  8 ++++----
 dom/media/eme/MediaKeyMessageEvent.cpp |  7 ++++---
 4 files changed, 25 insertions(+), 7 deletions(-)

diff --git a/dom/media/eme/EMEUtils.cpp b/dom/media/eme/EMEUtils.cpp
index 11eb0026e..93e7834e3 100644
--- a/dom/media/eme/EMEUtils.cpp
+++ b/dom/media/eme/EMEUtils.cpp
@@ -5,6 +5,8 @@
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/EMEUtils.h"
+
+#include "jsfriendapi.h" // for AutoCheckCannotGC
 #include "mozilla/dom/UnionTypes.h"
 
 namespace mozilla {
@@ -23,6 +25,7 @@ ArrayData
 GetArrayBufferViewOrArrayBufferData(const dom::ArrayBufferViewOrArrayBuffer& aBufferOrView)
 {
   MOZ_ASSERT(aBufferOrView.IsArrayBuffer() || aBufferOrView.IsArrayBufferView());
+  JS::AutoCheckCannotGC nogc;
   if (aBufferOrView.IsArrayBuffer()) {
     const dom::ArrayBuffer& buffer = aBufferOrView.GetAsArrayBuffer();
     buffer.ComputeLengthAndData();
@@ -39,6 +42,7 @@ void
 CopyArrayBufferViewOrArrayBufferData(const dom::ArrayBufferViewOrArrayBuffer& aBufferOrView,
                                      nsTArray<uint8_t>& aOutData)
 {
+  JS::AutoCheckCannotGC nogc;
   ArrayData data = GetArrayBufferViewOrArrayBufferData(aBufferOrView);
   aOutData.Clear();
   if (!data.IsValid()) {
@@ -47,6 +51,14 @@ CopyArrayBufferViewOrArrayBufferData(const dom::ArrayBufferViewOrArrayBuffer& aB
   aOutData.AppendElements(data.mData, data.mLength);
 }
 
+void CopyArrayBufferViewOrArrayBufferData(const dom::ArrayBuffer& aBuffer,
+                                          nsTArray<uint8_t>& aOutData) {
+  JS::AutoCheckCannotGC nogc;
+  aBuffer.ComputeLengthAndData();
+  aOutData.Clear();
+  aOutData.AppendElements(aBuffer.Data(), aBuffer.Length());
+}
+
 bool
 IsClearkeyKeySystem(const nsAString& aKeySystem)
 {
diff --git a/dom/media/eme/EMEUtils.h b/dom/media/eme/EMEUtils.h
index 4a2e5da18..b8f565329 100644
--- a/dom/media/eme/EMEUtils.h
+++ b/dom/media/eme/EMEUtils.h
@@ -11,6 +11,7 @@
 #include "mozilla/Logging.h"
 #include "nsString.h"
 #include "nsTArray.h"
+#include "mozilla/dom/TypedArray.h"
 
 namespace mozilla {
 
@@ -45,6 +46,10 @@ void
 CopyArrayBufferViewOrArrayBufferData(const dom::ArrayBufferViewOrArrayBuffer& aBufferOrView,
                                      nsTArray<uint8_t>& aOutData);
 
+// Overload for ArrayBuffer
+void CopyArrayBufferViewOrArrayBufferData(const dom::ArrayBuffer& aBufferOrView,
+                                          nsTArray<uint8_t>& aOutData);
+
 struct ArrayData {
   explicit ArrayData(const uint8_t* aData, size_t aLength)
     : mData(aData)
diff --git a/dom/media/eme/MediaEncryptedEvent.cpp b/dom/media/eme/MediaEncryptedEvent.cpp
index 8e2595fcb..fe1c8a3bc 100644
--- a/dom/media/eme/MediaEncryptedEvent.cpp
+++ b/dom/media/eme/MediaEncryptedEvent.cpp
@@ -87,10 +87,10 @@ MediaEncryptedEvent::Constructor(const GlobalObject& aGlobal,
   e->mInitDataType = aEventInitDict.mInitDataType;
   if (!aEventInitDict.mInitData.IsNull()) {
     const auto& a = aEventInitDict.mInitData.Value();
-    a.ComputeLengthAndData();
-    e->mInitData = ArrayBuffer::Create(aGlobal.Context(),
-                                       a.Length(),
-                                       a.Data());
+    nsTArray<uint8_t> initData;
+    CopyArrayBufferViewOrArrayBufferData(a, initData);
+    e->mInitData = ArrayBuffer::Create(aGlobal.Context(), initData.Length(),
+                                       initData.Elements());
     if (!e->mInitData) {
       aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
       return nullptr;
diff --git a/dom/media/eme/MediaKeyMessageEvent.cpp b/dom/media/eme/MediaKeyMessageEvent.cpp
index 37c509e67..289d0c16e 100644
--- a/dom/media/eme/MediaKeyMessageEvent.cpp
+++ b/dom/media/eme/MediaKeyMessageEvent.cpp
@@ -85,10 +85,11 @@ MediaKeyMessageEvent::Constructor(const GlobalObject& aGlobal,
   RefPtr<MediaKeyMessageEvent> e = new MediaKeyMessageEvent(owner);
   bool trusted = e->Init(owner);
   e->InitEvent(aType, aEventInitDict.mBubbles, aEventInitDict.mCancelable);
-  aEventInitDict.mMessage.ComputeLengthAndData();
+  nsTArray<uint8_t> initData;
+  CopyArrayBufferViewOrArrayBufferData(aEventInitDict.mMessage, initData);
   e->mMessage = ArrayBuffer::Create(aGlobal.Context(),
-                                    aEventInitDict.mMessage.Length(),
-                                    aEventInitDict.mMessage.Data());
+                                    initData.Length(),
+                                    initData.Elements());
   if (!e->mMessage) {
     aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
     return nullptr;