From 67c2983eed1067435114dbab8dd7b649aadad71c Mon Sep 17 00:00:00 2001 From: Nick Fitzgerald Date: Wed, 2 Mar 2016 13:16:00 -0500 Subject: [PATCH] Bug 1252912 - Ensure that we wrap the results of the shortestPaths JS shell testing function. r=jimb --HG-- extra : rebase_source : 997441c17bb884a7edaf17e5ee83c17f15112253 --- js/src/builtin/TestingFunctions.cpp | 5 ++++- js/src/jit-test/tests/heap-analysis/bug-1252912.js | 6 ++++++ 2 files changed, 10 insertions(+), 1 deletion(-) create mode 100644 js/src/jit-test/tests/heap-analysis/bug-1252912.js diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp index 2f13962e3fa0..096d4173544c 100644 --- a/js/src/builtin/TestingFunctions.cpp +++ b/js/src/builtin/TestingFunctions.cpp @@ -2776,8 +2776,11 @@ ShortestPaths(JSContext* cx, unsigned argc, Value* vp) return false; RootedValue predecessor(cx, values[i][j][k]); - if (!JS_DefineProperty(cx, part, "predecessor", predecessor, JSPROP_ENUMERATE)) + if (!cx->compartment()->wrap(cx, &predecessor) || + !JS_DefineProperty(cx, part, "predecessor", predecessor, JSPROP_ENUMERATE)) + { return false; + } if (names[i][j][k]) { RootedString edge(cx, NewStringCopyZ(cx, names[i][j][k].get())); diff --git a/js/src/jit-test/tests/heap-analysis/bug-1252912.js b/js/src/jit-test/tests/heap-analysis/bug-1252912.js new file mode 100644 index 000000000000..1240b45456c7 --- /dev/null +++ b/js/src/jit-test/tests/heap-analysis/bug-1252912.js @@ -0,0 +1,6 @@ +try { + x = evalcx('') + toSource = (function() { + }) +} catch (foo) {} +shortestPaths(this, ["$4"], 5)