wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 1155807 - Watch for converted native groups with unknown properties, r=jandem.

Browse Source
This commit is contained in:
Brian Hackett 2015-04-28 08:12:54 -07:00
parent 2ba65800c2
commit 2337513828
2 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
js/src/jit-test/tests/ion/bug1155807.js Normal file
View File

@ -0,0 +1,15 @@
for (var i = 0; i < 2; i++) {
setJitCompilerOption("ion.warmup.trigger", 8)
function f(state) {
this.s = state
}
f.prototype.g = function(v, y) {
this.t
}
x = ['', '']
j = new f(false)
x.filter(j.g, j)
x.filter(j.g, new f(false))
j.__proto__ = {}
}

4
js/src/jit/IonBuilder.cpp
View File

@ -9468,6 +9468,10 @@ IonBuilder::getDefiniteSlot(TemporaryTypeSet* types, PropertyName* name, uint32_
if (!convertUnboxedGroups.append(key->group()))
CrashAtUnhandlableOOM("IonBuilder::getDefiniteSlot");
key = TypeSet::ObjectKey::get(nativeGroup);
if (key->unknownProperties()) {
trackOptimizationOutcome(TrackedOutcome::UnknownProperties);
return UINT32_MAX;
}
}
}