wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 421325: array_join_sub does not handle holes in dense arrays correctly, r/a=shaver

Browse Source
This commit is contained in:
crowder@fiverocks.com 2008-03-07 16:16:51 -08:00
parent 5d6b77f364
commit 81d9657e21
1 changed files with 7 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
js/src/jsarray.c
View File

@ -375,20 +375,9 @@ GetArrayElement(JSContext *cx, JSObject *obj, jsuint index, JSBool *hole,
JSObject *obj2;
JSProperty *prop;
if (OBJ_IS_DENSE_ARRAY(cx, obj)) {
if (index >= ARRAY_DENSE_LENGTH(obj)) {
*vp = JSVAL_VOID;
*hole = JS_TRUE;
return JS_TRUE;
}
*vp = obj->dslots[index];
if (*vp == JSVAL_HOLE) {
*vp = JSVAL_VOID;
*hole = JS_TRUE;
} else {
if (OBJ_IS_DENSE_ARRAY(cx, obj) && index < ARRAY_DENSE_LENGTH(obj) &&
(*vp = obj->dslots[index]) != JSVAL_HOLE) {
*hole = JS_FALSE;
}
return JS_TRUE;
}
@ -1289,16 +1278,10 @@ array_join_sub(JSContext *cx, JSObject *obj, enum ArrayToStringOp op,
/* Use rval to locally root each element value as we loop and convert. */
for (index = 0; index < length; index++) {
if (OBJ_IS_DENSE_ARRAY(cx, obj) && index < ARRAY_DENSE_LENGTH(obj)) {
*rval = obj->dslots[index];
hole = (*rval == JSVAL_HOLE);
ok = JS_TRUE;
} else {
ok = (JS_CHECK_OPERATION_LIMIT(cx, JSOW_JUMP) &&
GetArrayElement(cx, obj, index, &hole, rval));
if (!ok)
goto done;
}
if (hole ||
(op != TO_SOURCE &&
(JSVAL_IS_VOID(*rval) || JSVAL_IS_NULL(*rval)))) {