mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-10-28 12:45:27 +00:00
Bug 665355 - Fix __proto__ recursion. r=mrbkap
--HG-- extra : rebase_source : b97d692c2318e3e071e68e2e1cec38ca9e614cb0
This commit is contained in:
parent
58bad94550
commit
f3d65acc81
@ -287,6 +287,17 @@ ArrayBuffer::obj_setProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp, J
|
||||
if (JSID_IS_ATOM(id, cx->runtime->atomState.byteLengthAtom))
|
||||
return true;
|
||||
|
||||
if (JSID_IS_ATOM(id, cx->runtime->atomState.protoAtom)) {
|
||||
if (!vp->isObjectOrNull())
|
||||
return JS_TRUE;
|
||||
|
||||
JSObject *pobj = vp->toObjectOrNull();
|
||||
if (!pobj)
|
||||
return JS_FALSE;
|
||||
|
||||
return SetProto(cx, obj, pobj, true);
|
||||
}
|
||||
|
||||
JSObject *delegate = DelegateObject(cx, obj);
|
||||
if (!delegate)
|
||||
return false;
|
||||
|
@ -105,3 +105,4 @@ script regress-646820-2.js
|
||||
script regress-646820-3.js
|
||||
script regress-643222.js
|
||||
script regress-614714.js
|
||||
script regress-665355.js
|
||||
|
13
js/src/tests/js1_8_5/regress/regress-665355.js
Normal file
13
js/src/tests/js1_8_5/regress/regress-665355.js
Normal file
@ -0,0 +1,13 @@
|
||||
var x = new ArrayBuffer(2);
|
||||
|
||||
var test = function() {
|
||||
try {
|
||||
x.__proto__ = x;
|
||||
return false;
|
||||
} catch(e) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
assertEq(test(), true);
|
||||
reportCompare(true, true);
|
Loading…
Reference in New Issue
Block a user