Bug 493281 - Find our object. r+sr=jst
authorBlake Kaplan <mrbkap@gmail.com>
Mon, 18 May 2009 16:45:29 -0700
changeset 28522 29664b7cdd11e5f15faca3001c34b88a2818d068
parent 28521 f67592bacc2074bf64eb9826e3587c1e9913ae9a
child 28523 4a32b3101121f0bf8bc34d0b183b23439f674894
push id7106
push usermrbkap@mozilla.com
push dateMon, 18 May 2009 23:53:32 +0000
treeherdermozilla-central@4a32b3101121 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs493281
milestone1.9.2a1pre
Bug 493281 - Find our object. r+sr=jst
dom/base/nsDOMClassInfo.cpp
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -8400,16 +8400,26 @@ nsHTMLDocumentSH::DocumentAllGetProperty
   // document.all.item and .namedItem get their value in the
   // newResolve hook, so nothing to do for those properties here. And
   // we need to return early to prevent <div id="item"> from shadowing
   // document.all.item(), etc.
   if (id == sItem_id || id == sNamedItem_id) {
     return JS_TRUE;
   }
 
+  while (STOBJ_GET_CLASS(obj) != &sHTMLDocumentAllClass) {
+    obj = STOBJ_GET_PROTO(obj);
+
+    if (!obj) {
+      NS_ERROR("The JS engine lies!");
+
+      return JS_TRUE;
+    }
+  }
+
   nsIHTMLDocument *doc = (nsIHTMLDocument *)::JS_GetPrivate(cx, obj);
   nsCOMPtr<nsIDOMHTMLDocument> domdoc(do_QueryInterface(doc));
   nsCOMPtr<nsISupports> result;
   nsresult rv = NS_OK;
 
   if (JSVAL_IS_STRING(id)) {
     if (id == sLength_id) {
       // Map document.all.length to the length of the collection