Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-28 12:45:27 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 665355 - Fix __proto__ recursion. r=mrbkap

Browse Source 
--HG--
extra : rebase_source : b97d692c2318e3e071e68e2e1cec38ca9e614cb0
This commit is contained in:
Nikhil Marathe 2011-06-29 17:41:35 -07:00
parent 58bad94550
commit f3d65acc81
3 changed files with 25 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
js/src/jstypedarray.cpp
View File

@ -287,6 +287,17 @@ ArrayBuffer::obj_setProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp, J
if (JSID_IS_ATOM(id, cx->runtime->atomState.byteLengthAtom))
return true;
if (JSID_IS_ATOM(id, cx->runtime->atomState.protoAtom)) {
if (!vp->isObjectOrNull())
return JS_TRUE;
JSObject *pobj = vp->toObjectOrNull();
if (!pobj)
return JS_FALSE;
return SetProto(cx, obj, pobj, true);
}
JSObject *delegate = DelegateObject(cx, obj);
if (!delegate)
return false;

1
js/src/tests/js1_8_5/regress/jstests.list
View File

@ -105,3 +105,4 @@ script regress-646820-2.js
script regress-646820-3.js
script regress-643222.js
script regress-614714.js
script regress-665355.js

13
js/src/tests/js1_8_5/regress/regress-665355.js Normal file
View File

@ -0,0 +1,13 @@
var x = new ArrayBuffer(2);
var test = function() {
try {
x.__proto__ = x;
return false;
} catch(e) {
return true;
}
}
assertEq(test(), true);
reportCompare(true, true);