Bug 1114566 - matchCallee: Check if both functions have a script before comparing them. r=shu

This commit is contained in:
Nicolas B. Pierron 2014-12-23 16:32:03 +01:00
parent 6e378a070c
commit aa29fbe0dd
2 changed files with 7 additions and 1 deletions

View File

@ -0,0 +1,2 @@
(new Function("return (function o() {}).caller;"))();

View File

@ -1124,8 +1124,12 @@ FrameIter::matchCallee(JSContext *cx, HandleFunction fun) const
// expect both functions to have the same JSScript. If so, and if they are
// different, then they cannot be equal.
bool useSameScript = CloneFunctionObjectUseSameScript(fun->compartment(), currentCallee);
if (useSameScript && currentCallee->nonLazyScript() != fun->nonLazyScript())
if (useSameScript &&
(currentCallee->hasScript() != fun->hasScript() ||
currentCallee->nonLazyScript() != fun->nonLazyScript()))
{
return false;
}
// If none of the previous filters worked, then take the risk of
// invalidating the frame to identify the JSFunction.