Bug 965898 - Don't reuse the JSPropertyDescriptor in BaseProxyHandler::keys. r=gabor

This causes garbage from a previous lookup to propagate into subsequent lookups,
and creates confusing situations (like having both a value and a getter).
This commit is contained in:
Bobby Holley 2014-07-30 12:23:03 -07:00
parent 293d52dd8f
commit 5fb6d9159f

View File

@ -237,7 +237,6 @@ BaseProxyHandler::keys(JSContext *cx, HandleObject proxy, AutoIdVector &props) c
return false;
/* Select only the enumerable properties through in-place iteration. */
Rooted<PropertyDescriptor> desc(cx);
RootedId id(cx);
size_t i = 0;
for (size_t j = 0, len = props.length(); j < len; j++) {
@ -247,6 +246,7 @@ BaseProxyHandler::keys(JSContext *cx, HandleObject proxy, AutoIdVector &props) c
continue;
AutoWaivePolicy policy(cx, proxy, id, BaseProxyHandler::GET);
Rooted<PropertyDescriptor> desc(cx);
if (!getOwnPropertyDescriptor(cx, proxy, id, &desc))
return false;
if (desc.object() && desc.isEnumerable())