Don't bother optimizing apply on arguments objects whose length property has been overridden (558609, r=dvander).

This commit is contained in:
Brendan Eich 2010-04-10 20:56:16 -07:00
parent e6e11bb6bf
commit 07efeb06be

View File

@ -2100,7 +2100,7 @@ js_fun_apply(JSContext *cx, uintN argc, jsval *vp)
sp = invokevp;
*sp++ = fval;
*sp++ = OBJECT_TO_JSVAL(obj);
if (aobj && aobj->isArguments()) {
if (aobj && aobj->isArguments() && !IsOverriddenArgsLength(aobj)) {
/*
* Two cases, two loops: note how in the case of an active stack frame
* backing aobj, even though we copy from fp->argv, we still must check