Bug 471214 - Join function objects transparently, clone via read barrier to satisfy de-facto standard (r=igor).

2009-07-28 13:20:14 -07:00
parent f969861105
commit c0e238ae3e
17 changed files with 535 additions and 213 deletions
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -792,7 +792,7 @@ array_getProperty(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
        if (prop) {
            if (OBJ_IS_NATIVE(obj2)) {
                sprop = (JSScopeProperty *) prop;
-                if (!js_NativeGet(cx, obj, obj2, sprop, vp))
+                if (!js_NativeGet(cx, obj, obj2, sprop, JSGET_METHOD_BARRIER, vp))
                    return JS_FALSE;
            }
            OBJ_DROP_PROPERTY(cx, obj2, prop);