Bug 608963 - Deal with an Xray wrapper being delegated to on the proto chain. r=gal a=blocking beta7

2010-11-02 11:26:43 -07:00 · 2010-11-02 11:26:43 -07:00 · 0ff87b11e3
--- a/js/src/xpconnect/crashtests/608963.html
+++ b/js/src/xpconnect/crashtests/608963.html
@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<script>
+Object.create(location).constructor;
+</script>
+
--- a/js/src/xpconnect/crashtests/crashtests.list
+++ b/js/src/xpconnect/crashtests/crashtests.list
@ -24,3 +24,4 @@ load 512815-1.html
 load 545291-1.html
 load 558979.html
 load 582649.html
+load 608963.html
--- a/js/src/xpconnect/wrappers/XrayWrapper.cpp
+++ b/js/src/xpconnect/wrappers/XrayWrapper.cpp
@ -720,7 +720,9 @@ XrayWrapper<Base, Policy>::get(JSContext *cx, JSObject *wrapper, JSObject *recei
                               js::Value *vp)
 {
    // Skip our Base if it isn't already JSProxyHandler.
-    return JSProxyHandler::get(cx, wrapper, receiver, id, vp);
+    // NB: None of the functions we call are prepared for the receiver not
+    // being the wrapper, so ignore the receiver here.
+    return JSProxyHandler::get(cx, wrapper, wrapper, id, vp);
 }

 template <typename Base, typename Policy>
@ -729,7 +731,9 @@ XrayWrapper<Base, Policy>::set(JSContext *cx, JSObject *wrapper, JSObject *recei
                               js::Value *vp)
 {
    // Skip our Base if it isn't already JSProxyHandler.
-    return JSProxyHandler::set(cx, wrapper, receiver, id, vp);
+    // NB: None of the functions we call are prepared for the receiver not
+    // being the wrapper, so ignore the receiver here.
+    return JSProxyHandler::set(cx, wrapper, wrapper, id, vp);
 }

 template <typename Base, typename Policy>