Bug 940629 - Root StackShape across getChildPropertyOnDictionary calls, r=bhackett

--HG--
extra : rebase_source : 57b54ad4f448107a323cf2810eb0231f5e1a1513
This commit is contained in:
Steve Fink 2013-11-19 12:32:33 -08:00
parent 368fe2ec96
commit 875baff1f6

View File

@ -393,6 +393,7 @@ JSObject::getChildPropertyOnDictionary(ThreadSafeContext *cx, JS::HandleObject o
JSObject::getChildProperty(ExclusiveContext *cx,
HandleObject obj, HandleShape parent, StackShape &child)
{
StackShape::AutoRooter childRoot(cx, &child);
RootedShape shape(cx, getChildPropertyOnDictionary(cx, obj, parent, child));
if (!shape) {
@ -412,6 +413,7 @@ JSObject::getChildProperty(ExclusiveContext *cx,
JSObject::lookupChildProperty(ThreadSafeContext *cx,
HandleObject obj, HandleShape parent, StackShape &child)
{
StackShape::AutoRooter childRoot(cx, &child);
JS_ASSERT(cx->isThreadLocal(obj));
RootedShape shape(cx, getChildPropertyOnDictionary(cx, obj, parent, child));