wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 708405. Make sure to propagate out failures from JS_HasPropertyById in the old nodelist resolve hook. r=mrbkap

Browse Source
This commit is contained in:
Boris Zbarsky 2011-12-15 14:36:46 -05:00
parent d7ae89edea
commit b4ae3f538d
3 changed files with 31 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
dom/base/crashtests/708405-1.html Normal file
View File

@ -0,0 +1,18 @@
<!DOCTYPE html>
<html>
<head>
<script>
function boom()
{
var a = document.getElementsByTagName("div");
a.__proto__ = Proxy.create({has: function() { throw new Error; }});
for (var p in a) {
}
}
</script>
</head>
<body onload="boom();"></body>
</html>

1
dom/base/crashtests/crashtests.list
View File

@ -33,3 +33,4 @@ load 693894.html
load 695867.html
load 697643.html
load 706283-1.html
load 708405-1.html

17
dom/base/nsDOMClassInfo.cpp
View File

@ -7974,12 +7974,19 @@ nsNamedArraySH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
}
JSObject *proto = ::JS_GetPrototype(cx, realObj);
JSBool hasProp;
if (proto && ::JS_HasPropertyById(cx, proto, id, &hasProp) && hasProp) {
// We found the property we're resolving on the prototype,
// nothing left to do here then.
return NS_OK;
if (proto) {
JSBool hasProp;
if (!::JS_HasPropertyById(cx, proto, id, &hasProp)) {
*_retval = false;
return NS_ERROR_FAILURE;
}
if (hasProp) {
// We found the property we're resolving on the prototype,
// nothing left to do here then.
return NS_OK;
}
}
}