Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-09 11:25:00 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix for bug 693894 (NodeList crash [@ js::GetObjectShape]). r=jst.

Browse Source 
--HG--
extra : rebase_source : fe485e60f87633861c3aadde95c29af6d81ddcc9
This commit is contained in:
Peter Van der Beken 2011-10-13 14:40:20 +02:00
parent 40feabd0e0
commit d636007fe7
3 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
dom/base/crashtests/693894.html Normal file
View File

@ -0,0 +1,8 @@
<!DOCTYPE html>
<script>
var nodeList = document.getElementsByName("html");
nodeList.__proto__ = null;
nodeList.x;
</script>

1
dom/base/crashtests/crashtests.list
View File

@ -29,3 +29,4 @@ load 612018-1.html
load 637116.html
load 666869.html
load 675621-1.html
load 693894.html

3
js/src/xpconnect/src/dombindings.cpp
View File

@ -918,6 +918,9 @@ ListBase<LC>::getPropertyOnPrototype(JSContext *cx, JSObject *proxy, jsid id, bo
js::Value *vp)
{
JSObject *proto = js::GetObjectProto(proxy);
if (!proto)
return true;
bool hit;
if (getProtoShape(proxy) != js::GetObjectShape(proto)) {
if (!shouldCacheProtoShape(cx, proto, &hit))