Bug 829813 - Add more checks for dense element lookup results, r=billmm.

2013-01-14 14:46:32 -07:00
parent b2f4f83167
commit 659dfcd3a9
7 changed files with 44 additions and 12 deletions
--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -1103,7 +1103,7 @@ SuppressDeletedPropertyHelper(JSContext *cx, HandleObject obj, StringPredicate p
                        if (prop) {
                            unsigned attrs;
                            if (obj2->isNative())
-                                attrs = prop->attributes();
+                                attrs = IsImplicitProperty(prop) ? JSPROP_ENUMERATE : prop->attributes();
                            else if (!JSObject::getGenericAttributes(cx, obj2, id, &attrs))
                                return false;