shithub: libmujs

Download patch

ref: c3715ce3db4cc37ea46af8dbc891ecee1ca1b2ff
parent: 6625d1ea02ffbca41bc5a58cbcac237ad563d552
author: Tor Andersson <tor.andersson@artifex.com>
date: Tue Jun 8 09:28:41 EDT 2021

Fix error in Array.prototype.toString().

--- a/jsarray.c
+++ b/jsarray.c
@@ -427,14 +427,16 @@
 		js_typeerror(J, "'this' is not an object");
 	js_getproperty(J, 0, "join");
 	if (!js_iscallable(J, -1)) {
-		// TODO: call Object.prototype.toString implementation; not via Object.toString JS objects
+		js_pop(J, 1);
+		// TODO: call Object.prototype.toString implementation directly
 		js_getglobal(J, "Object");
+		js_getproperty(J, -1, "prototype");
+		js_rot2pop1(J);
 		js_getproperty(J, -1, "toString");
 		js_rot2pop1(J);
 	}
 	js_copy(J, 0);
 	js_call(J, 0);
-	js_pop(J, 1);
 }
 
 static void Ap_indexOf(js_State *J)