mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-10-25 03:05:34 +00:00
Bug 1270977 - Mini-followup: JS::detail::ComputeThis must overwrite vp[1] with the boxed |this| object, because various downstream code assumes it's been overwritten (particularly in error cases). r=colors
This commit is contained in:
parent
70329fa4a6
commit
f20341eae2
@ -1310,8 +1310,8 @@ JS::detail::ComputeThis(JSContext* cx, Value* vp)
|
||||
AssertHeapIsIdle(cx);
|
||||
assertSameCompartment(cx, JSValueArray(vp, 2));
|
||||
|
||||
RootedValue thisv(cx, vp[1]);
|
||||
if (!BoxNonStrictThis(cx, thisv, &thisv))
|
||||
MutableHandleValue thisv = MutableHandleValue::fromMarkedLocation(&vp[1]);
|
||||
if (!BoxNonStrictThis(cx, thisv, thisv))
|
||||
return NullValue();
|
||||
|
||||
return thisv;
|
||||
|
Loading…
Reference in New Issue
Block a user