From: Igor Bukanov <igor@mir2.org>
Date: Thu, 20 Jan 2011 19:52:04 +0100
Subject: bug 563243 - backport of Blake Kaplan's tracemonkey/mozilla-central patch. a=clegnitto

---
 js/src/jsapi.cpp |   45 +++++++++++++++------------------------------
 1 files changed, 15 insertions(+), 30 deletions(-)

diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index bac3756..37cacb4 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -4440,12 +4440,11 @@ js_generic_fast_native_method_dispatcher(JSContext *cx, uintN argc, jsval *vp)
     fs = (JSFunctionSpec *) JSVAL_TO_PRIVATE(fsv);
     JS_ASSERT((~fs->flags & (JSFUN_FAST_NATIVE | JSFUN_GENERIC_NATIVE)) == 0);
 
-    /*
-     * We know that vp[2] is valid because JS_DefineFunctions, which is our
-     * only (indirect) referrer, defined us as requiring at least one argument
-     * (notice how it passes fs->nargs + 1 as the next-to-last argument to
-     * JS_DefineFunction).
-     */
+    if (argc < 1) {
+        js_ReportMissingArg(cx, vp, 0);
+        return JS_FALSE;
+    }
+
     if (JSVAL_IS_PRIMITIVE(vp[2])) {
         /*
          * Make sure that this is an object or null, as required by the generic
@@ -4470,15 +4469,9 @@ js_generic_fast_native_method_dispatcher(JSContext *cx, uintN argc, jsval *vp)
      */
     if (!js_ComputeThis(cx, JS_FALSE, vp + 2))
         return JS_FALSE;
-    /*
-     * Protect against argc underflowing. By calling js_ComputeThis, we made
-     * it as if the static was called with one parameter, the explicit |this|
-     * object.
-     */
-    if (argc != 0) {
-        /* Clear the last parameter in case too few arguments were passed. */
-        vp[2 + --argc] = JSVAL_VOID;
-    }
+
+    /* Clear the last parameter in case too few arguments were passed. */
+    vp[2 + --argc] = JSVAL_VOID;
 
     native =
 #ifdef JS_TRACER
@@ -4504,12 +4497,11 @@ js_generic_native_method_dispatcher(JSContext *cx, JSObject *obj,
     JS_ASSERT((fs->flags & (JSFUN_FAST_NATIVE | JSFUN_GENERIC_NATIVE)) ==
               JSFUN_GENERIC_NATIVE);
 
-    /*
-     * We know that argv[0] is valid because JS_DefineFunctions, which is our
-     * only (indirect) referrer, defined us as requiring at least one argument
-     * (notice how it passes fs->nargs + 1 as the next-to-last argument to
-     * JS_DefineFunction).
-     */
+    if (argc < 1) {
+        js_ReportMissingArg(cx, argv - 2, 0);
+        return JS_FALSE;
+    }
+
     if (JSVAL_IS_PRIMITIVE(argv[0])) {
         /*
          * Make sure that this is an object or null, as required by the generic
@@ -4537,15 +4529,8 @@ js_generic_native_method_dispatcher(JSContext *cx, JSObject *obj,
     js_GetTopStackFrame(cx)->thisp = JSVAL_TO_OBJECT(argv[-1]);
     JS_ASSERT(cx->fp->argv == argv);
 
-    /*
-     * Protect against argc underflowing. By calling js_ComputeThis, we made
-     * it as if the static was called with one parameter, the explicit |this|
-     * object.
-     */
-    if (argc != 0) {
-        /* Clear the last parameter in case too few arguments were passed. */
-        argv[--argc] = JSVAL_VOID;
-    }
+    /* Clear the last parameter in case too few arguments were passed. */
+    argv[--argc] = JSVAL_VOID;
 
     return fs->call(cx, JSVAL_TO_OBJECT(argv[-1]), argc, argv, rval);
 }
