From 2bc0c0e60f1b679e050039e5127561102b833386 Mon Sep 17 00:00:00 2001 From: "mrbkap%gmail.com" Date: Mon, 11 Aug 2008 18:24:13 +0000 Subject: [PATCH] Don't do things to the object before we're sure it's the right type of object. bug 443569, r=brendan a=ss --- js/src/jsregexp.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/js/src/jsregexp.c b/js/src/jsregexp.c index c1e1f61e71b..6da14d48f61 100644 --- a/js/src/jsregexp.c +++ b/js/src/jsregexp.c @@ -3622,12 +3622,17 @@ regexp_getProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp) if (!JSVAL_IS_INT(id)) return JS_TRUE; + while (OBJ_GET_CLASS(cx, obj) != &js_RegExpClass) { + obj = OBJ_GET_PROTO(cx, obj); + if (!obj) + return JS_TRUE; + } slot = JSVAL_TO_INT(id); if (slot == REGEXP_LAST_INDEX) return JS_GetReservedSlot(cx, obj, 0, vp); JS_LOCK_OBJ(cx, obj); - re = (JSRegExp *) JS_GetInstancePrivate(cx, obj, &js_RegExpClass, NULL); + re = (JSRegExp *) JS_GetPrivate(cx, obj); if (re) { switch (slot) { case REGEXP_SOURCE: @@ -3661,6 +3666,11 @@ regexp_setProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp) ok = JS_TRUE; if (!JSVAL_IS_INT(id)) return ok; + while (OBJ_GET_CLASS(cx, obj) != &js_RegExpClass) { + obj = OBJ_GET_PROTO(cx, obj); + if (!obj) + return JS_TRUE; + } slot = JSVAL_TO_INT(id); if (slot == REGEXP_LAST_INDEX) { if (!JS_ValueToNumber(cx, *vp, &lastIndex))