wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 458271 - Property cache causes resolve hooks not to be called. r=brendan.

Browse Source
This commit is contained in:
Jason Orendorff 2010-08-07 14:57:59 -05:00
parent c834b35395
commit 6e4e0d61ae
4 changed files with 62 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
dom/tests/mochitest/bugs/Makefile.in
View File

@ -119,6 +119,7 @@ _TEST_FILES = \
test_DOMWindowCreated_chromeonly.html \
test_bug581072.html \
test_bug583225.html \
test_bug458271.html \
$(NULL)
libs:: $(_TEST_FILES)

48
dom/tests/mochitest/bugs/test_bug458271.html Normal file
View File

@ -0,0 +1,48 @@
<!DOCTYPE HTML>
<html>
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=458271
-->
<head>
<title>Test for Bug 458271</title>
<script type="application/javascript" src="/MochiKit/packed.js"></script>
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
</head>
<body>
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=458271">Mozilla Bug 458271</a>
<p id="display"></p>
<div id="content" style="display: none">
</div>
<pre id="test">
<script type="application/javascript">
/** Test for Bug 458271 **/
// Note: this test uses GC to force the property cache to be purged. If
// bug 506341 is fixed, that won't work anymore, and this test will be
// less reliable. (That is, regressing bug 458271 would cause this test to
// fail randomly, not reliably.)
var f;
function lookup() {
return f.target;
}
var content = document.getElementById("content");
for (var i = 0; i < 4; i++) {
content.innerHTML = '<form name="f"></form>';
f = document.forms.f;
netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
Components.utils.forceGC();
f.innerHTML = ''; // make sure later f.innerHTML doesn't change shape
lookup();
lookup(); // nsIDOMHTMLFormElement.target goes into propcache
f.innerHTML = '<input type="text" name="target">'; // shadows f.target
is(typeof lookup(), "object",
"lookup must find form input, not shadowed DOM attribute");
}
</script>
</pre>
</body>
</html>

13
js/src/jspropertycache.cpp
View File

@ -101,13 +101,18 @@ PropertyCache::fill(JSContext *cx, JSObject *obj, uintN scopeIndex, uintN protoI
protoIndex = 1;
for (;;) {
tmp = tmp->getProto();
/*
* We cannot cache properties coming from native objects behind
* non-native ones on the prototype chain. The non-natives can
* mutate in arbitrary way without changing any shapes.
* non-native objects, or objects with resolve hooks, on the
* prototype chain. Such objects can mutate without changing any
* shapes.
*/
if (tmp->getClass()->resolve) {
PCMETER(noprotos++);
return JS_NO_PROP_CACHE_FILL;
}
tmp = tmp->getProto();
if (!tmp || !tmp->isNative()) {
PCMETER(noprotos++);
return JS_NO_PROP_CACHE_FILL;

5
js/src/jstracer.cpp
View File

@ -9443,7 +9443,6 @@ TraceRecorder::test_property_cache(JSObject* obj, LIns* obj_ins, JSObject*& obj2
JS_PROPERTY_CACHE(cx).test(cx, pc, aobj, obj2, entry, atom);
if (atom) {
// Miss: pre-fill the cache for the interpreter, as well as for our needs.
// FIXME: bug 458271.
jsid id = ATOM_TO_JSID(atom);
// The lookup below may change object shapes.
@ -9484,6 +9483,10 @@ TraceRecorder::test_property_cache(JSObject* obj, LIns* obj_ins, JSObject*& obj2
if (prop) {
if (!obj2->isNative())
RETURN_STOP_A("property found on non-native object");
// This property cache fill is necessary for correctness! It
// returns JS_NO_PROP_CACHE_FILL if the above lookup called any
// resolve hooks, which must inhibit tracing. See bug 458271.
entry = JS_PROPERTY_CACHE(cx).fill(cx, aobj, 0, protoIndex, obj2,
(JSScopeProperty*) prop);
JS_ASSERT(entry);