Merge pull request #195 from bryan-m-hughes/timob-13906-1_0_X

[TIMOB-13906] Fixed unknown values being passed to function.apply crash
appcelerator-archive · May 17, 2013 · 20dbff9 · 20dbff9
2 parents 97c856b + 7a8b54a
commit 20dbff9
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 4 deletions.
diff --git a/lib/Base.js b/lib/Base.js
@@ -5111,6 +5111,7 @@ ObjectProtoToStringFunc,
 UndefinedType,
 isCallable,
 isType,
+type,
 isObject,
 toUint32,
 FunctionType,
@@ -5191,8 +5192,14 @@ FunctionProtoApplyFunc.prototype.callFunction = wrapNativeCall(function callFunc
 		return new UnknownType();
 	}
 
-	for (i = 0, len = toUint32(argArray.get('length')).value; i < len; i++) {
-		argList.push(argArray.get(i));
+	if (type(argArray) === 'Unknown') {
+		for (i = 0, len = toUint32(this.get('length')).value; i < len; i++) {
+			argList.push(new UnknownType());
+		}
+	} else {
+		for (i = 0, len = toUint32(argArray.get('length')).value; i < len; i++) {
+			argList.push(argArray.get(i));
+		}
 	}
 
 	return thisVal.callFunction(thisArg, argList);

diff --git a/lib/base/prototypes/function.js b/lib/base/prototypes/function.js
@@ -8,6 +8,7 @@ ObjectProtoToStringFunc,
 UndefinedType,
 isCallable,
 isType,
+type,
 isObject,
 toUint32,
 FunctionType,
@@ -88,8 +89,14 @@ FunctionProtoApplyFunc.prototype.callFunction = wrapNativeCall(function callFunc
 		return new UnknownType();
 	}
 
-	for (i = 0, len = toUint32(argArray.get('length')).value; i < len; i++) {
-		argList.push(argArray.get(i));
+	if (type(argArray) === 'Unknown') {
+		for (i = 0, len = toUint32(this.get('length')).value; i < len; i++) {
+			argList.push(new UnknownType());
+		}
+	} else {
+		for (i = 0, len = toUint32(argArray.get('length')).value; i < len; i++) {
+			argList.push(argArray.get(i));
+		}
 	}
 
 	return thisVal.callFunction(thisArg, argList);