corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 606141. ArrayCompPush can deep-bail, so handle that. r=jorendorff

Browse Source
This commit is contained in:
Boris Zbarsky
2010-11-04 16:37:44 -04:00
parent 322633ed37
commit 711a139be2
2 changed files with 13 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
js/src/jsarray.cpp
View File

@@ -2001,10 +2001,15 @@ js_ArrayCompPush(JSContext *cx, JSObject *obj, const Value &vp)
JSBool JS_FASTCALL
js_ArrayCompPush_tn(JSContext *cx, JSObject *obj, ValueArgType v)
{
return ArrayCompPushImpl(cx, obj, ValueArgToConstRef(v));
if (!ArrayCompPushImpl(cx, obj, ValueArgToConstRef(v))) {
SetBuiltinError(cx);
return JS_FALSE;
}
return cx->tracerState->builtinStatus == 0;
}
JS_DEFINE_CALLINFO_3(extern, BOOL, js_ArrayCompPush_tn, CONTEXT, OBJECT, VALUE,
0, nanojit::ACCSET_STORE_ANY)
JS_DEFINE_CALLINFO_3(extern, BOOL_FAIL, js_ArrayCompPush_tn, CONTEXT, OBJECT,
VALUE, 0, nanojit::ACCSET_STORE_ANY)
static JSBool
array_push(JSContext *cx, uintN argc, Value *vp)