From 3d69a522d5cfc396abffb4e8c4b0e43fdaa5dad4 Mon Sep 17 00:00:00 2001 From: "brendan%mozilla.org" Date: Fri, 1 Mar 2002 23:26:09 +0000 Subject: [PATCH] Fix call_enumerate to reflect compiler-created properties from function to its call object (127557, r=jband, sr=shaver, a=asa). git-svn-id: svn://10.0.0.236/trunk@115592 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/js/src/jsfun.c | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/mozilla/js/src/jsfun.c b/mozilla/js/src/jsfun.c index 87708116b14..4b898fccc8b 100644 --- a/mozilla/js/src/jsfun.c +++ b/mozilla/js/src/jsfun.c @@ -708,13 +708,29 @@ call_enumerate(JSContext *cx, JSObject *obj) fp = (JSStackFrame *) JS_GetPrivate(cx, obj); if (!fp) return JS_TRUE; - funobj = fp->argv ? JSVAL_TO_OBJECT(fp->argv[-2]) : fp->fun->object; + + /* + * Do not enumerate a cloned function object at fp->argv[-2], it may have + * gained its own (mutable) scope (e.g., a brutally-shared XUL script sets + * the clone's prototype property). We must enumerate the function object + * that was decorated with parameter and local variable properties by the + * compiler when the compiler created fp->fun, namely fp->fun->object. + * + * Contrast with call_resolve, where we prefer fp->argv[-2], because we'll + * use js_LookupProperty to find any overridden properties in that object, + * if it was a mutated clone; and if not, we will search its prototype, + * fp->fun->object, to find compiler-created params and locals. + */ + funobj = fp->fun->object; if (!funobj) return JS_TRUE; - /* Reflect actual args for formal parameters and local variables. */ + /* + * Reflect actual args from fp->argv for formal parameters, and local vars + * and functions in fp->vars for declared variables and nested-at-top-level + * local functions. + */ scope = OBJ_SCOPE(funobj); - for (sprop = SCOPE_LAST_PROP(scope); sprop; sprop = sprop->parent) { getter = sprop->getter; if (getter != js_GetArgument && getter != js_GetLocalVariable)