Bug 867749 - When cloning objects for self-hosting, clone with a null prototype to eliminate poisoning concerns from that global's standard objects. r=till

--HG--
extra : rebase_source : 414b9f1f0e07e762b4c88c35efc1be3f6abfcb60
This commit is contained in:
Jeff Walden 2013-05-01 17:12:56 -07:00
parent a957c2a44a
commit 1b9d11688c

View File

@ -656,8 +656,8 @@ CloneObject(JSContext *cx, HandleObject srcObj, CloneMemory &clonedObjects)
clone = NewDenseEmptyArray(cx);
} else {
JS_ASSERT(srcObj->isNative());
clone = NewObjectWithClassProto(cx, srcObj->getClass(), NULL, cx->global(),
srcObj->tenuredGetAllocKind());
clone = NewObjectWithGivenProto(cx, srcObj->getClass(), NULL, cx->global(),
srcObj->tenuredGetAllocKind(), SingletonObject);
}
if (!clone || !clonedObjects.relookupOrAdd(p, srcObj.get(), clone.get()) ||
!CloneProperties(cx, srcObj, clone, clonedObjects))