Bug 1033920 - Handle null in XrayWrapper::setPrototypeOf. v1 r=efaust

From ac73068c4494c0df74329482e57f64ba8ec93cb4 Mon Sep 17 00:00:00 2001
This commit is contained in:
Bobby Holley 2014-07-02 21:06:28 -07:00
parent 89916d5337
commit 0c673473c1
3 changed files with 9 additions and 1 deletions

View File

@ -0,0 +1,7 @@
const Cu = Components.utils;
function run_test() {
var sb = Cu.Sandbox('http://www.example.com');
var o = new sb.Object();
o.__proto__ = null;
do_check_eq(Object.getPrototypeOf(o), null);
}

View File

@ -44,6 +44,7 @@ support-files =
[test_bug1001094.js]
[test_bug1021312.js]
[test_bug1033253.js]
[test_bug1033920.js]
[test_bug_442086.js]
[test_file.js]
[test_blob.js]

View File

@ -2653,7 +2653,7 @@ XrayWrapper<Base, Traits>::setPrototypeOf(JSContext *cx, JS::HandleObject wrappe
// The expando lives in the target's compartment, so do our installation there.
JSAutoCompartment ac(cx, target);
RootedValue v(cx, ObjectValue(*proto));
RootedValue v(cx, ObjectOrNullValue(proto));
if (!JS_WrapValue(cx, &v))
return false;
JS_SetReservedSlot(expando, JSSLOT_EXPANDO_PROTOTYPE, v);