Bug 993057 - Fix Xrays to disallow indexed expando properties on Xrays for Window with a WebIDL binding. r=bholley.
authorPeter Van der Beken <peterv@propagandism.org>
Sat, 15 Feb 2014 22:12:35 +0100
changeset 177577 8920c42b19309e22a71db54ae5992c19386248f2
parent 177576 b6a353fc2b947c67192e2ac6535a9b99da33c1ec
child 177578 a502db5137ab95d9b3093aa31b0df517ce78b5f2
push id26556
push userryanvm@gmail.com
push dateTue, 08 Apr 2014 22:16:57 +0000
treeherdermozilla-central@5811efc11011 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbholley
bugs993057
milestone31.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 993057 - Fix Xrays to disallow indexed expando properties on Xrays for Window with a WebIDL binding. r=bholley.
js/xpconnect/wrappers/XrayWrapper.cpp
--- a/js/xpconnect/wrappers/XrayWrapper.cpp
+++ b/js/xpconnect/wrappers/XrayWrapper.cpp
@@ -1449,26 +1449,28 @@ DOMXrayTraits::resolveOwnProperty(JSCont
     return true;
 }
 
 bool
 DOMXrayTraits::defineProperty(JSContext *cx, HandleObject wrapper, HandleId id,
                               MutableHandle<JSPropertyDescriptor> desc,
                               Handle<JSPropertyDescriptor> existingDesc, bool *defined)
 {
-    if (!existingDesc.object())
-        return true;
-
     // Check for an indexed property on a Window.  If that's happening, do
     // nothing but claim we defined it so it won't get added as an expando.
-    int32_t index = GetArrayIndexFromId(cx, id);
-    if (IsArrayIndex(index) && IsWindow(cx, wrapper)) {
-        *defined = true;
+    if (IsWindow(cx, wrapper)) {
+        int32_t index = GetArrayIndexFromId(cx, id);
+        if (IsArrayIndex(index)) {
+            *defined = true;
+            return true;
+        }
+    }
+
+    if (!existingDesc.object())
         return true;
-    }
 
     JS::Rooted<JSObject*> obj(cx, getTargetObject(wrapper));
     return XrayDefineProperty(cx, wrapper, obj, id, desc, defined);
 }
 
 bool
 DOMXrayTraits::enumerateNames(JSContext *cx, HandleObject wrapper, unsigned flags,
                               AutoIdVector &props)