Bug 1190727 - Make initialization of temporary results array resilien…

…t against Array.prototype setters in self-hosted Map#next implementation. r=jandem
Brli · Aug 4, 2015 · 2cce936 · 2cce936
1 parent 45a2083
commit 2cce936
Showing 1 changed file with 2 additions and 5 deletions.
diff --git a/js/src/builtin/Map.js b/js/src/builtin/Map.js
@@ -47,11 +47,8 @@ function MapIteratorNext() {
     // Steps 8-9 (omitted).
 
     var mapIterationResultPair = iteratorTemp.mapIterationResultPair;
-    if (!mapIterationResultPair) {
-        mapIterationResultPair = iteratorTemp.mapIterationResultPair = NewDenseArray(2);
-        mapIterationResultPair[0] = null;
-        mapIterationResultPair[1] = null;
-    }
+    if (!mapIterationResultPair)
+        mapIterationResultPair = iteratorTemp.mapIterationResultPair = [null, null];
 
     var retVal = {value: undefined, done: true};