Bug 545291 - Don't lookup non-quickstubbed properties. r=jorendorff

2010-02-11 17:04:42 -08:00 · 2010-02-11 17:04:42 -08:00 · 7761c930de
--- a/js/src/xpconnect/crashtests/545291-1.html
+++ b/js/src/xpconnect/crashtests/545291-1.html
@ -0,0 +1,12 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script>
+
+var textNode = document.createTextNode("x");
+textNode.__proto__.__proto__ = Components;
+textNode.__lookupSetter__("canCallMethod")();
+
+</script>
+</head>
+</html>
--- a/js/src/xpconnect/crashtests/crashtests.list
+++ b/js/src/xpconnect/crashtests/crashtests.list
@ -19,3 +19,4 @@ load 471366-1.html
 load 475185-1.html
 load 475291-1.html
 load 503286-1.html
+load 545291-1.html
--- a/js/src/xpconnect/src/xpcquickstubs.cpp
+++ b/js/src/xpconnect/src/xpcquickstubs.cpp
@ -295,7 +295,8 @@ LookupGetterOrSetter(JSContext *cx, JSBool wantGetter, uintN argc, jsval *vp)
    if(!name ||
       !IS_PROTO_CLASS(STOBJ_GET_CLASS(desc.obj)) ||
       (desc.attrs & (JSPROP_GETTER | JSPROP_SETTER)) ||
-       !(desc.getter || desc.setter))
+       !(desc.getter || desc.setter) ||
+       desc.setter == STOBJ_GET_CLASS(desc.obj)->setProperty)
    {
        JS_SET_RVAL(cx, vp, JSVAL_VOID);
        return JS_TRUE;