Do not attempt to lock a non-native object. bug 436741, r=brendan a=ss
git-svn-id: svn://10.0.0.236/trunk@253514 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
@@ -3344,7 +3344,8 @@ js_LookupPropertyWithFlags(JSContext *cx, JSObject *obj, jsid id, uintN flags,
|
||||
/* Resolved: juggle locks and lookup id again. */
|
||||
if (obj2 != obj) {
|
||||
JS_UNLOCK_OBJ(cx, obj);
|
||||
JS_LOCK_OBJ(cx, obj2);
|
||||
if (OBJ_IS_NATIVE(obj2))
|
||||
JS_LOCK_OBJ(cx, obj2);
|
||||
}
|
||||
protoIndex = 0;
|
||||
for (proto = start; proto && proto != obj2;
|
||||
@@ -3355,7 +3356,6 @@ js_LookupPropertyWithFlags(JSContext *cx, JSObject *obj, jsid id, uintN flags,
|
||||
if (!MAP_IS_NATIVE(&scope->map)) {
|
||||
/* Whoops, newresolve handed back a foreign obj2. */
|
||||
JS_ASSERT(obj2 != obj);
|
||||
JS_UNLOCK_OBJ(cx, obj2);
|
||||
ok = OBJ_LOOKUP_PROPERTY(cx, obj2, id, objp, propp);
|
||||
if (!ok || *propp)
|
||||
goto cleanup;
|
||||
@@ -3376,7 +3376,8 @@ js_LookupPropertyWithFlags(JSContext *cx, JSObject *obj, jsid id, uintN flags,
|
||||
JS_ASSERT(obj2 == scope->object);
|
||||
obj = obj2;
|
||||
} else if (obj2 != obj) {
|
||||
JS_UNLOCK_OBJ(cx, obj2);
|
||||
if (OBJ_IS_NATIVE(obj2))
|
||||
JS_UNLOCK_OBJ(cx, obj2);
|
||||
JS_LOCK_OBJ(cx, obj);
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user