зеркало из https://github.com/mozilla/pjs.git
Don't crash on non-primitive array indexes (484120, r=jwalden).
This commit is contained in:
Родитель
5532b329ec
Коммит
e994b74262
|
@ -7162,6 +7162,8 @@ TraceRecorder::record_JSOP_GETELEM()
|
||||||
|
|
||||||
/* Property access using a string name or something we have to stringify. */
|
/* Property access using a string name or something we have to stringify. */
|
||||||
if (!JSVAL_IS_INT(idx)) {
|
if (!JSVAL_IS_INT(idx)) {
|
||||||
|
if (!JSVAL_IS_PRIMITIVE(idx))
|
||||||
|
ABORT_TRACE("non-primitive index");
|
||||||
// If index is not a string, turn it into a string.
|
// If index is not a string, turn it into a string.
|
||||||
if (!js_InternNonIntElementId(cx, obj, idx, &id))
|
if (!js_InternNonIntElementId(cx, obj, idx, &id))
|
||||||
ABORT_TRACE("failed to intern non-int element id");
|
ABORT_TRACE("failed to intern non-int element id");
|
||||||
|
|
Загрузка…
Ссылка в новой задаче