corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 580200 - Assertion failure, or duplicated enumeration, enumerating own properties of proxy returning duplicated property names. r=jorendorff

Browse Source
This commit is contained in:
Jeff Walden
2010-07-20 12:46:58 -05:00
parent 97234703cc
commit efb706461b
3 changed files with 37 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
js/src/jsiter.cpp
View File

@@ -206,7 +206,7 @@ Enumerate(JSContext *cx, JSObject *obj, JSObject *pobj, jsid id,
JS_ASSERT(JSID_IS_INT(id) || JSID_IS_ATOM(id));
IdSet::AddPtr p = ht.lookupForAdd(id);
JS_ASSERT_IF(obj == pobj, !p);
JS_ASSERT_IF(obj == pobj && !obj->isProxy(), !p);
/* If we've already seen this, we definitely won't add it. */
if (JS_UNLIKELY(!!p))
@@ -214,9 +214,10 @@ Enumerate(JSContext *cx, JSObject *obj, JSObject *pobj, jsid id,
/*
* It's not necessary to add properties to the hash table at the end of the
* prototype chain.
* prototype chain -- but a proxy might return duplicated properties, so
* always add for them.
*/
if (pobj->getProto() && !ht.add(p, id))
if ((pobj->getProto() || pobj->isProxy()) && !ht.add(p, id))
return false;
if (JS_UNLIKELY(flags & JSITER_OWNONLY)) {