Bug 618176 - Skip multiple wrappers when deciding whether this object is an array. r=gal

This commit is contained in:
Blake Kaplan
2011-04-12 15:56:45 -07:00
parent 08ba947c8c
commit 0e5c53d8fc
2 changed files with 3 additions and 3 deletions

View File

@@ -2580,7 +2580,7 @@ array_concat(JSContext *cx, uintN argc, Value *vp)
if (v.isObject()) {
aobj = &v.toObject();
if (aobj->isArray() ||
(aobj->isWrapper() && JSWrapper::wrappedObject(aobj)->isArray())) {
(aobj->isWrapper() && aobj->unwrap()->isArray())) {
jsid id = ATOM_TO_JSID(cx->runtime->atomState.lengthAtom);
if (!aobj->getProperty(cx, id, tvr.addr()))
return false;
@@ -3026,7 +3026,7 @@ array_isArray(JSContext *cx, uintN argc, Value *vp)
vp->setBoolean(argc > 0 &&
vp[2].isObject() &&
((obj = &vp[2].toObject())->isArray() ||
(obj->isWrapper() && JSWrapper::wrappedObject(obj)->isArray())));
(obj->isWrapper() && obj->unwrap()->isArray())));
return true;
}