bug 375406 - PutProperty E4X correctness fix. r=brendan

2009-03-25 16:02:29 +01:00
parent efdb7c0a2b
commit 147f7880e1
1 changed files with 3 additions and 2 deletions
--- a/js/src/jsxml.cpp
+++ b/js/src/jsxml.cpp
@@ -4288,8 +4288,9 @@ PutProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
                    goto out;
                attr = (JSXML *) JS_GetPrivate(cx, JSVAL_TO_OBJECT(*vp));

-                /* 2(e)(iii). */
-                xml->xml_kids.vector[i] = attr->xml_kids.vector[0];
+                /* 2(e)(iii) - the length check comes from the bug 375406. */
+                if (attr->xml_kids.length != 0)
+                    xml->xml_kids.vector[i] = attr->xml_kids.vector[0];
            }
        }