wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Fix crash in ic::Name with weird scope chains (bug 616508, r=dmandelin).

Browse Source
This commit is contained in:
David Anderson 2010-12-03 11:46:53 -08:00
parent 4b36cd08d6
commit c10306346a
2 changed files with 19 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
js/src/jit-test/tests/jaeger/bug616508.js Normal file
View File

@ -0,0 +1,9 @@
// |jit-test| error: ReferenceError
// vim: set ts=4 sw=4 tw=99 et:
try {
(function () {
__proto__ = Uint32Array()
}())
} catch (e) {}(function () {
length, ([eval()] ? x : 7)
})()

21
js/src/methodjit/PolyIC.cpp
View File

@ -1477,17 +1477,16 @@ class ScopeNameCompiler : public PICStubCompiler
return false;
}
if (!obj->isNative() || !holder->isNative()) {
if (!obj->getProperty(cx, ATOM_TO_JSID(atom), vp))
return false;
} else {
const Shape *shape = getprop.shape;
JS_ASSERT(shape);
JSObject *normalized = obj;
if (obj->getClass() == &js_WithClass && !shape->hasDefaultGetter())
normalized = js_UnwrapWithObject(cx, obj);
NATIVE_GET(cx, normalized, holder, shape, JSGET_METHOD_BARRIER, vp, return false);
}
// If the property was found, but we decided not to cache it, then
// take a slow path and do a full property fetch.
if (!getprop.shape)
return obj->getProperty(cx, ATOM_TO_JSID(atom), vp);
const Shape *shape = getprop.shape;
JSObject *normalized = obj;
if (obj->getClass() == &js_WithClass && !shape->hasDefaultGetter())
normalized = js_UnwrapWithObject(cx, obj);
NATIVE_GET(cx, normalized, holder, shape, JSGET_METHOD_BARRIER, vp, return false);
return true;
}