From 5ec92c71a33012219c87f4668e0016e341b4f5d9 Mon Sep 17 00:00:00 2001 From: Brian Hackett Date: Tue, 28 Apr 2015 11:05:28 -0700 Subject: [PATCH] Bug 1155292 - Add a check for properties found on non-native prototypes during Ion caching, r=jandem. --- js/src/jit/IonCaches.cpp | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/js/src/jit/IonCaches.cpp b/js/src/jit/IonCaches.cpp index f1a63f9020a..36d6f149d74 100644 --- a/js/src/jit/IonCaches.cpp +++ b/js/src/jit/IonCaches.cpp @@ -3041,8 +3041,11 @@ CanAttachNativeSetProp(JSContext* cx, HandleObject obj, HandleId id, ConstantOrR // a stub to add the property until we do the VM call to add. If the // property exists as a data property on the prototype, we should add // a new, shadowing property. - if (obj->isNative() && (!shape || (obj != holder && shape->hasDefaultSetter() && shape->hasSlot()))) + if (obj->isNative() && (!shape || (obj != holder && holder->isNative() && + shape->hasDefaultSetter() && shape->hasSlot()))) + { return SetPropertyIC::MaybeCanAttachAddSlot; + } if (IsImplicitNonNativeProperty(shape)) return SetPropertyIC::CanAttachNone;