Bug 608868 part 2: verify that scope chain start is native before IC'ing, r=dvander, a=beta8+

This commit is contained in:
David Mandelin 2010-11-09 12:28:11 -08:00
parent 126b6b5647
commit a7b546995a

View File

@ -698,6 +698,8 @@ struct GetPropertyHelper {
return ic.error(cx);
if (!prop)
return ic.disable(cx, "lookup failed");
if (!obj->isNative())
return ic.disable(cx, "non-native");
if (!IsCacheableProtoChain(obj, holder))
return ic.disable(cx, "non-native holder");
shape = (const Shape *)prop;