Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-20 16:55:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1268574 - Check the outparam JSFunction* value after GetGetterPure. r=lth

Browse Source
This commit is contained in:
Tooru Fujisawa 2016-04-29 02:46:22 +09:00
parent 6f80eee720
commit aa8be126c7
4 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
js/src/jit-test/tests/basic/testArrayBufferSpeciesDelete.js Normal file
View File

@ -0,0 +1,5 @@
delete ArrayBuffer[Symbol.species];
var a = new Uint8Array(new Uint8Array([1, 2]));
assertEq(a.length, 2);
assertEq(a[0], 1);
assertEq(a[1], 2);

5
js/src/jit-test/tests/basic/testArraySpeciesDelete.js Normal file
View File

@ -0,0 +1,5 @@
delete Array[Symbol.species];
var a = [1, 2, 3].slice(1);
assertEq(a.length, 2);
assertEq(a[0], 2);
assertEq(a[1], 3);

3
js/src/jsarray.cpp
View File

@ -923,6 +923,9 @@ IsArraySpecies(JSContext* cx, HandleObject origArray)
if (!GetGetterPure(cx, ctorObj, speciesId, &getter))
return false;
if (!getter)
return false;
return IsSelfHostedFunctionWithName(getter, cx->names().ArraySpecies);
}

3
js/src/vm/TypedArrayObject.cpp
View File

@ -787,6 +787,9 @@ IsArrayBufferSpecies(JSContext* cx, HandleObject origBuffer)
if (!GetGetterPure(cx, ctorObj, speciesId, &getter))
return false;
if (!getter)
return false;
return IsSelfHostedFunctionWithName(getter, cx->names().ArrayBufferSpecies);
}