Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-16 06:45:42 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 434837 - Accessors in prototype chain of arrays don't assign 'this' correctly, r=shaver, r=brendan

Browse Source
This commit is contained in:
bcrowder@mozilla.com 2008-05-21 12:24:25 -07:00
parent 833f7809a7
commit 2250d2e485
1 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
js/src/jsarray.cpp
View File

@ -701,13 +701,29 @@ array_getProperty(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
if (!js_IdIsIndex(ID_TO_VALUE(id), &i) || i >= ARRAY_DENSE_LENGTH(obj) ||
obj->dslots[i] == JSVAL_HOLE) {
JSObject *obj2;
JSProperty *prop;
JSScopeProperty *sprop;
JSObject *proto = STOBJ_GET_PROTO(obj);
if (!proto) {
*vp = JSVAL_VOID;
return JS_TRUE;
}
return OBJ_GET_PROPERTY(cx, proto, id, vp);
*vp = JSVAL_VOID;
if (js_LookupPropertyWithFlags(cx, proto, id, 0, &obj2, &prop) < 0)
return JS_FALSE;
if (prop) {
if (OBJ_IS_NATIVE(obj2)) {
sprop = (JSScopeProperty *) prop;
if (!js_NativeGet(cx, obj, obj2, sprop, vp))
return JS_FALSE;
}
OBJ_DROP_PROPERTY(cx, obj2, prop);
}
return JS_TRUE;
}
*vp = obj->dslots[i];