Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-02-26 20:30:41 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1177907 - Handle ObjectClassIs exception in date_toString. r=till

Browse Source 
--HG--
extra : rebase_source : ae93a8075b640110c0e2ffa9af329bc2ee97ee98
This commit is contained in:
André Bargull 2015-06-30 04:36:00 -04:00
parent 9bb1d88ef2
commit c85151b95d
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
js/src/jit-test/tests/basic/bug1177907.js Normal file
View File

@ -0,0 +1,4 @@
// |jit-test| error: InternalError
var Date_toString = newGlobal().Date.prototype.toString;
(function f(){ f(Date_toString.call({})); })();

6
js/src/jsdate.cpp
View File

@ -2883,9 +2883,13 @@ date_toString(JSContext* cx, unsigned argc, Value* vp)
if (ObjectClassIs(obj, ESClass_Date, cx)) {
// Step 3.a.
RootedValue unboxed(cx);
Unbox(cx, obj, &unboxed);
if (!Unbox(cx, obj, &unboxed))
return false;
tv = unboxed.toNumber();
}
// ObjectClassIs can throw for objects from other compartments.
if (cx->isExceptionPending())
return false;
}
// Step 4.
return date_format(cx, tv, FORMATSPEC_FULL, args.rval());