wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 639737 - JS_THIS_OBJECT can fail and we need to catch when it does. r=jst

Browse Source 
--HG--
extra : rebase_source : 0ecd6f2666c506bbf5837ef14092fcb47c8e5b3b
This commit is contained in:
Blake Kaplan 2011-03-08 15:04:37 -08:00
parent 6de99f0675
commit c54ec6b730
3 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
js/src/xpconnect/crashtests/639737-1.html Normal file
View File

@ -0,0 +1,19 @@
<!DOCTYPE html>
<html>
<head>
<script>
function b() {
try { sset("u"); } catch(e) { }
try { [0].map(b); } catch(e) { }
}
var sset = document.documentElement.style.__lookupSetter__("textIndent");
b();
</script>
</head>
<body></body>
</html>

1
js/src/xpconnect/crashtests/crashtests.list
View File

@ -29,3 +29,4 @@ load 558979.html
load 582649.html
load 603858-1.html
load 608963.html
load 639737-1.html

2
js/src/xpconnect/src/xpcquickstubs.cpp
View File

@ -148,6 +148,8 @@ PropertyOpForwarder(JSContext *cx, uintN argc, jsval *vp)
JSObject *callee = JSVAL_TO_OBJECT(JS_CALLEE(cx, vp));
JSObject *obj = JS_THIS_OBJECT(cx, vp);
if (!obj)
return JS_FALSE;
jsval v;
if(!JS_GetReservedSlot(cx, callee, 0, &v))