Skip to content

Commit d62765e

Browse files
author
Jianchun Xu
committed
[MERGE chakra-core#3210 @jianchun] fix an invalid DynamicObject* cast
Merge pull request chakra-core#3210 from jianchun:castconfus Scope objects are not always "DynamicObject"s (e.g. may be of type "WithScopeObject"). Use RecyclerObject instead.
2 parents d278ce5 + 2440805 commit d62765e

1 file changed

Lines changed: 4 additions & 3 deletions

File tree

lib/Runtime/Language/JavascriptOperators.cpp

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2812,7 +2812,7 @@ namespace Js
28122812
ScriptContext *const scriptContext = functionBody->GetScriptContext();
28132813

28142814
uint16 length = pDisplay->GetLength();
2815-
DynamicObject *object;
2815+
RecyclableObject *object;
28162816

28172817
PropertyValueInfo info;
28182818
PropertyValueInfo::SetCacheInfo(&info, functionBody, inlineCache, inlineCacheIndex, !IsFromFullJit);
@@ -2822,7 +2822,7 @@ namespace Js
28222822

28232823
for (uint16 i = 0; i < length; i++)
28242824
{
2825-
object = (DynamicObject*)pDisplay->GetItem(i);
2825+
object = RecyclableObject::FromVar(pDisplay->GetItem(i));
28262826

28272827
AssertMsg(!ConsoleScopeActivationObject::Is(object) || (i == length - 1), "Invalid location for ConsoleScopeActivationObject");
28282828

@@ -7558,7 +7558,8 @@ namespace Js
75587558
PropertyValueInfo::SetCacheInfo(&info, functionBody, inlineCache, inlineCacheIndex, !IsFromFullJit);
75597559
for (uint16 i = 0; i < length; i++)
75607560
{
7561-
DynamicObject* object = (DynamicObject*)pDisplay->GetItem(i);
7561+
RecyclableObject* object = RecyclableObject::FromVar(pDisplay->GetItem(i));
7562+
75627563
Var value;
75637564
if (CacheOperators::TryGetProperty<true, true, true, false, true, true, !TInlineCache::IsPolymorphic, TInlineCache::IsPolymorphic, false>(
75647565
object, false, object, propertyId, &value, scriptContext, nullptr, &info))

0 commit comments

Comments
 (0)