r=brendan

Bug #21836, apply didn't check for non-object argument.
This commit is contained in:
rogerl%netscape.com 1999-12-22 22:00:07 +00:00
parent 56d5bbb958
commit e2125cefc6

View File

@ -1241,9 +1241,11 @@ fun_apply(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
argc = 0;
} else {
/* The second arg must be an array (or arguments object). */
aobj = JSVAL_TO_OBJECT(argv[1]);
if (OBJ_GET_CLASS(cx, aobj) != &js_ArgumentsClass &&
OBJ_GET_CLASS(cx, aobj) != &js_ArrayClass) {
if (JSVAL_IS_PRIMITIVE(argv[1]) ||
(aobj = JSVAL_TO_OBJECT(argv[1]),
OBJ_GET_CLASS(cx, aobj) != &js_ArgumentsClass &&
OBJ_GET_CLASS(cx, aobj) != &js_ArrayClass))
{
JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
JSMSG_BAD_APPLY_ARGS);
return JS_FALSE;