corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 373118 - Fix handling of explicitly-provided |undefined| as an optional argument to various JS functions ([].sort, [].slice, "".slice, "".substr, "".substring). r=jwalden

Browse Source
This commit is contained in:
Tom Schuster
2010-10-21 15:02:02 -07:00
parent 6a3c2e6fd8
commit 3a0cbbc2ce
4 changed files with 40 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
js/src/jsarray.cpp
View File

@@ -1724,7 +1724,7 @@ js::array_sort(JSContext *cx, uintN argc, Value *vp)
Value *argv = JS_ARGV(cx, vp);
Value fval;
if (argc > 0) {
if (argc > 0 && !argv[0].isUndefined()) {
if (argv[0].isPrimitive()) {
JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_BAD_SORT_ARG);
return false;
@@ -2464,7 +2464,7 @@ array_slice(JSContext *cx, uintN argc, Value *vp)
}
begin = (jsuint)d;
if (argc > 1) {
if (argc > 1 && !argv[1].isUndefined()) {
if (!ValueToNumber(cx, argv[1], &d))
return JS_FALSE;
d = js_DoubleToInteger(d);