wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 486578 - TM: "Assertion failure: scope->object == pobj" with function, __proto__, length. r=gal

Browse Source
This commit is contained in:
Jeff Walden 2009-04-04 16:55:51 -07:00
parent fa2e6466b2
commit 14e879800f
2 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
js/src/jstracer.cpp
View File

@ -5933,6 +5933,11 @@ TraceRecorder::test_property_cache(JSObject* obj, LIns* obj_ins, JSObject*& obj2
ABORT_TRACE("failed to lookup property");
if (prop) {
if (!OBJ_IS_NATIVE(obj2)) {
OBJ_DROP_PROPERTY(cx, obj2, prop);
ABORT_TRACE("property found on non-native object");
}
js_FillPropertyCache(cx, aobj, OBJ_SHAPE(aobj), 0, protoIndex, obj2,
(JSScopeProperty*) prop, &entry);
}

22
js/src/trace-test.js
View File

@ -4790,6 +4790,28 @@ testNewWithNonNativeProto.jitstats = {
};
test(testNewWithNonNativeProto);
function testLengthOnNonNativeProto()
{
var o = {};
o.__proto__ = [3];
for (var j = 0; j < 5; j++)
o[0];
var o2 = {};
o2.__proto__ = [];
for (var j = 0; j < 5; j++)
o2.length;
function foo() { }
foo.__proto__ = [];
for (var j = 0; j < 5; j++)
foo.length;
return "no assertion";
}
testLengthOnNonNativeProto.expected = "no assertion";
test(testLengthOnNonNativeProto);
/*****************************************************************************
* *