Bug 564208 - Don't run getters while enumerating. r=jst

--HG--
extra : rebase_source : 64df2342d0946b232543ae935cdff6162a05358c
This commit is contained in:
Blake Kaplan 2010-06-10 14:11:09 -07:00
parent c1a1fb9be1
commit a1651aaa59
3 changed files with 35 additions and 1 deletions

View File

@ -8021,7 +8021,7 @@ nsGenericArraySH::Enumerate(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
jsval len_val; jsval len_val;
JSAutoRequest ar(cx); JSAutoRequest ar(cx);
JSBool ok = ::JS_GetProperty(cx, obj, "length", &len_val); JSBool ok = JS_LookupProperty(cx, obj, "length", &len_val);
if (ok && JSVAL_IS_INT(len_val)) { if (ok && JSVAL_IS_INT(len_val)) {
PRInt32 length = JSVAL_TO_INT(len_val); PRInt32 length = JSVAL_TO_INT(len_val);

View File

@ -116,6 +116,7 @@ _TEST_FILES = \
test_bug563487.html \ test_bug563487.html \
test_bug545314.html \ test_bug545314.html \
test_bug548828.html \ test_bug548828.html \
test_bug564208.html \
test_DOMWindowCreated_chromeonly.html \ test_DOMWindowCreated_chromeonly.html \
$(NULL) $(NULL)

View File

@ -0,0 +1,33 @@
<!DOCTYPE HTML>
<html>
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=564208
-->
<head>
<title>Test for Bug 564208</title>
<script type="text/javascript" src="/MochiKit/packed.js"></script>
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=564208">Mozilla Bug 564208</a>
<p id="display"></p>
<div id="content" style="display: none">
</div>
<pre id="test">
<script class="testbody" type="text/javascript">
/** Test for Bug 564208 **/
var sawLength = false;
var c = document.childNodes;
c.__proto__ = document.createTextNode(" ");
for (var i in c) { if (i === "length") sawLength = true; }
ok(sawLength, "property enumerated length");
</script>
</pre>
</body>
</html>