Mark uncacheable prototypes on objects whose prototype has dynamically changed, bug 703047.

This commit is contained in:
Brian Hackett 2011-11-18 13:28:07 -08:00
parent 61189d725a
commit 2f44413ef8
6 changed files with 4 additions and 23 deletions

View File

@ -119,16 +119,7 @@ JS_FRIEND_API(JSObject *)
JS_NewObjectWithUniqueType(JSContext *cx, JSClass *clasp, JSObject *proto, JSObject *parent)
{
JSObject *obj = JS_NewObject(cx, clasp, proto, parent);
if (!obj || !obj->setSingletonType(cx) || !obj->setUncacheableProto(cx))
return NULL;
return obj;
}
JS_FRIEND_API(JSObject *)
JS_NewObjectWithUncacheableProto(JSContext *cx, JSClass *clasp, JSObject *proto, JSObject *parent)
{
JSObject *obj = JS_NewObject(cx, clasp, proto, parent);
if (!obj || !obj->setUncacheableProto(cx))
if (!obj || !obj->setSingletonType(cx))
return NULL;
return obj;
}

View File

@ -67,9 +67,6 @@ JS_SplicePrototype(JSContext *cx, JSObject *obj, JSObject *proto);
extern JS_FRIEND_API(JSObject *)
JS_NewObjectWithUniqueType(JSContext *cx, JSClass *clasp, JSObject *proto, JSObject *parent);
extern JS_FRIEND_API(JSObject *)
JS_NewObjectWithUncacheableProto(JSContext *cx, JSClass *clasp, JSObject *proto, JSObject *parent);
extern JS_FRIEND_API(uint32)
JS_ObjectCountDynamicSlots(JSObject *obj);

View File

@ -4997,8 +4997,8 @@ SetProto(JSContext *cx, JSObject *obj, JSObject *proto, bool checkForCycles)
* prototype lookups will not be cached across these.
*/
JSObject *oldproto = obj;
while (oldproto && oldproto->isNative() && !oldproto->hasUncacheableProto()) {
if (!oldproto->protoShapeChange(cx))
while (oldproto && oldproto->isNative()) {
if (!oldproto->setUncacheableProto(cx))
return false;
oldproto = oldproto->getProto();
}

View File

@ -606,7 +606,6 @@ struct JSObject : js::gc::Cell
inline bool nativeEmpty() const;
js::Shape *methodShapeChange(JSContext *cx, const js::Shape &shape);
bool protoShapeChange(JSContext *cx);
bool shadowingShapeChange(JSContext *cx, const js::Shape &shape);
/*

View File

@ -1132,12 +1132,6 @@ JSObject::methodShapeChange(JSContext *cx, const Shape &shape)
return result;
}
bool
JSObject::protoShapeChange(JSContext *cx)
{
return generateOwnShape(cx);
}
bool
JSObject::shadowingShapeChange(JSContext *cx, const Shape &shape)
{

View File

@ -666,7 +666,7 @@ xpc_NewSystemInheritingJSObject(JSContext *cx, JSClass *clasp, JSObject *proto,
} else if (uniqueType) {
obj = JS_NewObjectWithUniqueType(cx, clasp, proto, parent);
} else {
obj = JS_NewObjectWithUncacheableProto(cx, clasp, proto, parent);
obj = JS_NewObject(cx, clasp, proto, parent);
}
if (obj && JS_IsSystemObject(cx, parent) && !JS_MakeSystemObject(cx, obj))
obj = NULL;