Bug 935586 - Fix an exact rooting hazard in getIntrinsicValue; r=bhackett

--HG--
extra : rebase_source : eca4c08e60a5583c18a6f1d985ff1a86d19c8a7e
This commit is contained in:
Terrence Cole 2013-11-06 09:06:57 -08:00
parent 5201dd0149
commit 5072dc5910

View File

@ -529,9 +529,10 @@ class GlobalObject : public JSObject
bool getIntrinsicValue(JSContext *cx, HandlePropertyName name, MutableHandleValue value) {
if (maybeGetIntrinsicValue(name, value.address()))
return true;
Rooted<GlobalObject*> self(cx, this);
if (!cx->runtime()->cloneSelfHostedValue(cx, name, value))
return false;
RootedObject holder(cx, intrinsicsHolder());
RootedObject holder(cx, self->intrinsicsHolder());
RootedId id(cx, NameToId(name));
return JS_DefinePropertyById(cx, holder, id, value, nullptr, nullptr, 0);
}