mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
Bug 620376 - ArrayToIdVector from jsproxy.cpp should check for operation callback invocations. r=gal
This commit is contained in:
parent
603766b9f3
commit
3e0168d2c2
@ -407,14 +407,14 @@ ArrayToIdVector(JSContext *cx, const Value &array, AutoIdVector &props)
|
|||||||
|
|
||||||
JSObject *obj = &array.toObject();
|
JSObject *obj = &array.toObject();
|
||||||
jsuint length;
|
jsuint length;
|
||||||
if (!js_GetLengthProperty(cx, obj, &length)) {
|
if (!js_GetLengthProperty(cx, obj, &length))
|
||||||
JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_BAD_ARRAY_LENGTH);
|
|
||||||
return false;
|
return false;
|
||||||
}
|
|
||||||
|
|
||||||
AutoIdRooter idr(cx);
|
AutoIdRooter idr(cx);
|
||||||
AutoValueRooter tvr(cx);
|
AutoValueRooter tvr(cx);
|
||||||
for (jsuint n = 0; n < length; ++n) {
|
for (jsuint n = 0; n < length; ++n) {
|
||||||
|
if (!JS_CHECK_OPERATION_LIMIT(cx))
|
||||||
|
return false;
|
||||||
if (!js_IndexToId(cx, n, idr.addr()))
|
if (!js_IndexToId(cx, n, idr.addr()))
|
||||||
return false;
|
return false;
|
||||||
if (!obj->getProperty(cx, idr.id(), tvr.addr()))
|
if (!obj->getProperty(cx, idr.id(), tvr.addr()))
|
||||||
|
@ -60,3 +60,5 @@ script regress-617405-2.js
|
|||||||
script regress-618572.js
|
script regress-618572.js
|
||||||
skip-if(!xulRuntime.shell) script regress-618576.js # uses evalcx
|
skip-if(!xulRuntime.shell) script regress-618576.js # uses evalcx
|
||||||
fails-if(!xulRuntime.shell) script regress-618652.js
|
fails-if(!xulRuntime.shell) script regress-618652.js
|
||||||
|
script regress-620376-1.js
|
||||||
|
script regress-620376-2.js
|
||||||
|
21
js/src/tests/js1_8_5/regress/regress-620376-1.js
Normal file
21
js/src/tests/js1_8_5/regress/regress-620376-1.js
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
/*
|
||||||
|
* Any copyright is dedicated to the Public Domain.
|
||||||
|
* http://creativecommons.org/licenses/publicdomain/
|
||||||
|
* Contributors: Igor Bukanov
|
||||||
|
*/
|
||||||
|
|
||||||
|
function test() {
|
||||||
|
if (typeof timeout != "function")
|
||||||
|
return;
|
||||||
|
|
||||||
|
var p = Proxy.create({ enumerate: function() { return Array(1e9); }});
|
||||||
|
|
||||||
|
expectExitCode(6);
|
||||||
|
timeout(0.001);
|
||||||
|
|
||||||
|
var n = 0;
|
||||||
|
for (i in p) { ++n;}
|
||||||
|
return n;
|
||||||
|
}
|
||||||
|
|
||||||
|
test();
|
19
js/src/tests/js1_8_5/regress/regress-620376-2.js
Normal file
19
js/src/tests/js1_8_5/regress/regress-620376-2.js
Normal file
@ -0,0 +1,19 @@
|
|||||||
|
/*
|
||||||
|
* Any copyright is dedicated to the Public Domain.
|
||||||
|
* http://creativecommons.org/licenses/publicdomain/
|
||||||
|
* Contributors: Igor Bukanov
|
||||||
|
*/
|
||||||
|
|
||||||
|
function test() {
|
||||||
|
var p = Proxy.create({ enumerate: function() { return { get length() { throw 1; }}; }});
|
||||||
|
|
||||||
|
try {
|
||||||
|
for (i in p);
|
||||||
|
throw new Error("an exception should be thrown");
|
||||||
|
} catch (e) {
|
||||||
|
assertEq(e, 1);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
test();
|
||||||
|
reportCompare(0, 0, "ok");
|
Loading…
Reference in New Issue
Block a user