Bug 835496 - Don't try to fix the types for object initializers with dense elements, r=jandem.

This commit is contained in:
Brian Hackett 2013-01-29 07:03:38 -07:00
parent 42d12beb79
commit 34f1ba9368
2 changed files with 7 additions and 1 deletions

View File

@ -0,0 +1,6 @@
// |jit-test| error: TypeError
(function([{x}]) {})({
t: 0,
"1": 0
})

View File

@ -3248,7 +3248,7 @@ TypeCompartment::fixObjectType(JSContext *cx, HandleObject obj)
*/
JS_ASSERT(obj->isObject());
if (obj->slotSpan() == 0 || obj->inDictionaryMode())
if (obj->slotSpan() == 0 || obj->inDictionaryMode() || !obj->hasEmptyElements())
return;
ObjectTypeTable::AddPtr p = objectTypeTable->lookupForAdd(obj.get());