corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Properly reject new arrays with negative length (530617, r=jwalden).

Browse Source
This commit is contained in:
Andreas Gal
2009-11-23 16:09:02 -08:00
parent 3e78facc33
commit 7b14994f5f
4 changed files with 32 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
js/src/jsarray.cpp
View File

@@ -3427,6 +3427,21 @@ js_NewEmptyArray(JSContext* cx, JSObject* proto)
JS_DEFINE_CALLINFO_2(extern, OBJECT, js_NewEmptyArray, CONTEXT, OBJECT, 0, 0)
#endif
JSObject* JS_FASTCALL
js_NewEmptyArrayWithLength(JSContext* cx, JSObject* proto, int32 len)
{
if (len < 0)
return NULL;
JSObject *obj = js_NewEmptyArray(cx, proto);
if (!obj)
return NULL;
obj->fslots[JSSLOT_ARRAY_LENGTH] = len;
return obj;
}
#ifdef JS_TRACER
JS_DEFINE_CALLINFO_3(extern, OBJECT, js_NewEmptyArrayWithLength, CONTEXT, OBJECT, INT32, 0, 0)
#endif
JSObject* JS_FASTCALL
js_NewArrayWithSlots(JSContext* cx, JSObject* proto, uint32 len)
{