Cope with stillborn Iterators (558619, r=dvander).
authorBrendan Eich <brendan@mozilla.org>
Sat, 10 Apr 2010 23:47:43 -0700
changeset 40861 4932aaad496277d9007d164b0f6e4f012aaa8f39
parent 40860 341ffe867ea84220bb0e6f9b9834bbb7c8b58004
child 40862 91ca703f8d6947d5d84042d9cb145867bd4f7e8a
push id1
push userroot
push dateMon, 20 Oct 2014 17:29:22 +0000
reviewersdvander
bugs558619
milestone1.9.3a5pre
Cope with stillborn Iterators (558619, r=dvander).
js/src/jsiter.cpp
--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -97,16 +97,20 @@ CloseNativeIterator(JSContext *cx, JSObj
 
     JS_ASSERT(iterobj->getClass() == &js_IteratorClass);
 
     /* Avoid double work if CloseNativeIterator was called on obj. */
     state = iterobj->getSlot(JSSLOT_ITER_STATE);
     if (JSVAL_IS_NULL(state))
         return;
 
+    /* Avoid misinterpreting default-void slots in a stillborn iterator. */
+    if (JSVAL_IS_VOID(state))
+        return;
+
     /* Protect against failure to fully initialize obj. */
     iterable = iterobj->getParent();
     if (iterable) {
 #if JS_HAS_XML_SUPPORT
         uintN flags = JSVAL_TO_INT(iterobj->getSlot(JSSLOT_ITER_FLAGS));
         if ((flags & JSITER_FOREACH) && OBJECT_IS_XML(cx, iterable)) {
             js_EnumerateXMLValues(cx, iterable, JSENUMERATE_DESTROY, &state,
                                   NULL, NULL);