mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
Bug 631098 - Ensure slow arrays always have a length property. r=brendan, a=b
This commit is contained in:
parent
7f57bd46bb
commit
e8e463d19c
@ -1001,6 +1001,16 @@ Class js_SlowArrayClass = {
|
||||
js_TryValueOf
|
||||
};
|
||||
|
||||
static bool
|
||||
AddLengthProperty(JSContext *cx, JSObject *obj)
|
||||
{
|
||||
const jsid lengthId = ATOM_TO_JSID(cx->runtime->atomState.lengthAtom);
|
||||
JS_ASSERT(!obj->nativeLookup(lengthId));
|
||||
|
||||
return obj->addProperty(cx, lengthId, array_length_getter, array_length_setter,
|
||||
SHAPE_INVALID_SLOT, JSPROP_PERMANENT | JSPROP_SHARED, 0, 0);
|
||||
}
|
||||
|
||||
/*
|
||||
* Convert an array object from fast-and-dense to slow-and-flexible.
|
||||
*/
|
||||
@ -1027,9 +1037,7 @@ JSObject::makeDenseArraySlow(JSContext *cx)
|
||||
* Begin with the length property to share more of the property tree.
|
||||
* The getter/setter here will directly access the object's private value.
|
||||
*/
|
||||
if (!addProperty(cx, ATOM_TO_JSID(cx->runtime->atomState.lengthAtom),
|
||||
array_length_getter, array_length_setter,
|
||||
SHAPE_INVALID_SLOT, JSPROP_PERMANENT | JSPROP_SHARED, 0, 0)) {
|
||||
if (!AddLengthProperty(cx, this)) {
|
||||
setMap(oldMap);
|
||||
return false;
|
||||
}
|
||||
@ -3088,7 +3096,7 @@ JSObject *
|
||||
NewSlowEmptyArray(JSContext *cx)
|
||||
{
|
||||
JSObject *obj = NewNonFunction<WithProto::Class>(cx, &js_SlowArrayClass, NULL, NULL);
|
||||
if (!obj)
|
||||
if (!obj || !AddLengthProperty(cx, obj))
|
||||
return NULL;
|
||||
|
||||
obj->setArrayLength(0);
|
||||
|
Loading…
Reference in New Issue
Block a user