wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge tracemonkey to mozilla-central a=blockers.

Browse Source
This commit is contained in:
Robert Sayre 2010-10-26 20:50:55 -04:00
commit 735dc25cad
9 changed files with 64 additions and 65 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
dom/base/crashtests/603531.html Normal file
View File

@ -0,0 +1,18 @@
<!DOCTYPE html>
<html>
<head>
<script>
function boom()
{
var frame = document.getElementById("f");
var frameWindow = frame.contentWindow;
document.body.removeChild(frame);
document.body.setUserData("x", frameWindow, null);
document.body.setUserData("x", "", null);
}
</script>
</head>
<body onload="boom();"><iframe id="f" src="data:text/html,"></iframe></body>
</html>

1
dom/base/crashtests/crashtests.list
View File

@ -22,4 +22,5 @@ load 499006-1.html
load 499006-2.html
load 502617.html
asserts(1) load 504224.html # bug 564098
load 603531.html
load 601247.html

34
js/src/jsinterp.cpp
View File

@ -4293,13 +4293,13 @@ BEGIN_CASE(JSOP_SETMETHOD)
JSAtom *atom;
if (cache->testForSet(cx, regs.pc, obj, &entry, &obj2, &atom)) {
/*
* Fast property cache hit, only partially confirmed by
* testForSet. We know that the entry applies to regs.pc and
* that obj's shape matches.
* Property cache hit, only partially confirmed by testForSet. We
* know that the entry applies to regs.pc and that obj's shape
* matches.
*
* The entry predicts either a new property to be added
* directly to obj by this set, or on an existing "own"
* property, or on a prototype property that has a setter.
* The entry predicts either a new property to be added directly to
* obj by this set, or on an existing "own" property, or on a
* prototype property that has a setter.
*/
const Shape *shape = entry->vword.toShape();
JS_ASSERT_IF(shape->isDataDescriptor(), shape->writable());
@ -4382,26 +4382,12 @@ BEGIN_CASE(JSOP_SETMETHOD)
}
}
PCMETER(cache->setpcmisses++);
atom = NULL;
} else if (!atom) {
/*
* Slower property cache hit, fully confirmed by testForSet (in the
* slow path, via fullTest).
*/
ASSERT_VALID_PROPERTY_CACHE_HIT(0, obj, obj2, entry);
const Shape *shape = NULL;
if (obj == obj2) {
shape = entry->vword.toShape();
JS_ASSERT(shape->writable());
JS_ASSERT(obj2->isExtensible());
NATIVE_SET(cx, obj, shape, entry, &rval);
}
if (shape)
break;
LOAD_ATOM(0, atom);
} else {
JS_ASSERT(atom);
}
if (!atom)
LOAD_ATOM(0, atom);
jsid id = ATOM_TO_JSID(atom);
if (entry && JS_LIKELY(!obj->getOps()->setProperty)) {
uintN defineHow;

6
js/src/jsobj.cpp
View File

@ -1697,10 +1697,8 @@ js_NewPropertyDescriptorObject(JSContext *cx, jsid id, uintN attrs,
JSBool
js_GetOwnPropertyDescriptor(JSContext *cx, JSObject *obj, jsid id, Value *vp)
{
if (obj->isProxy()) {
if (!JSProxy::getOwnPropertyDescriptor(cx, obj, id, false, vp))
return false;
}
if (obj->isProxy())
return JSProxy::getOwnPropertyDescriptor(cx, obj, id, false, vp);
JSObject *pobj;
JSProperty *prop;

6
js/src/jspropertycache.h
View File

@ -236,11 +236,7 @@ class PropertyCache
/*
* Test for cached information about a property set on *objp at pc.
*
* On a fast hit, set *entryp to the entry and return true.
*
* On a slow hit, set *entryp to the entry, set *obj2p to the object that
* owns the property (either obj or a prototype), set *atomp to NULL, and
* return false.
* On a hit, set *entryp to the entry and return true.
*
* On a miss, set *atomp to the name of the property being set and return false.
*/

14
js/src/jspropertycacheinlines.h
View File

@ -115,16 +115,12 @@ PropertyCache::testForSet(JSContext *cx, jsbytecode *pc, JSObject *obj,
if (entry->kpc == pc && entry->kshape == shape)
return true;
#ifdef DEBUG
JSObject *orig = obj;
#endif
JSAtom *atom = fullTest(cx, pc, &obj, obj2p, entry);
if (atom) {
PCMETER(misses++);
PCMETER(setmisses++);
} else {
JS_ASSERT(obj == orig);
}
JS_ASSERT(atom);
PCMETER(misses++);
PCMETER(setmisses++);
*atomp = atom;
return false;
}

33
js/src/methodjit/StubCalls.cpp
View File

@ -153,13 +153,13 @@ stubs::SetName(VMFrame &f, JSAtom *origAtom)
JSAtom *atom;
if (cache->testForSet(cx, f.regs.pc, obj, &entry, &obj2, &atom)) {
/*
* Fast property cache hit, only partially confirmed by
* testForSet. We know that the entry applies to regs.pc and
* that obj's shape matches.
* Property cache hit, only partially confirmed by testForSet. We
* know that the entry applies to regs.pc and that obj's shape
* matches.
*
* The entry predicts either a new property to be added
* directly to obj by this set, or on an existing "own"
* property, or on a prototype property that has a setter.
* The entry predicts either a new property to be added directly to
* obj by this set, or on an existing "own" property, or on a
* prototype property that has a setter.
*/
const Shape *shape = entry->vword.toShape();
JS_ASSERT_IF(shape->isDataDescriptor(), shape->writable());
@ -241,25 +241,12 @@ stubs::SetName(VMFrame &f, JSAtom *origAtom)
}
}
PCMETER(cache->setpcmisses++);
atom = NULL;
} else if (!atom) {
/*
* Slower property cache hit, fully confirmed by testForSet (in the
* slow path, via fullTest).
*/
const Shape *shape = NULL;
if (obj == obj2) {
shape = entry->vword.toShape();
JS_ASSERT(shape->writable());
JS_ASSERT(obj2->isExtensible());
NATIVE_SET(cx, obj, shape, entry, &rval);
}
if (shape)
break;
atom = origAtom;
} else {
JS_ASSERT(atom);
}
if (!atom)
atom = origAtom;
jsid id = ATOM_TO_JSID(atom);
if (entry && JS_LIKELY(!obj->getOps()->setProperty)) {
uintN defineHow;

1
js/src/tests/ecma_5/extensions/jstests.list
View File

@ -7,3 +7,4 @@ script String-toSource.js
script proxy-strict.js
script regress-bug567606.js
script string-literal-getter-setter-decompilation.js
script regress-bug607284.js

16
js/src/tests/ecma_5/extensions/regress-bug607284.js Normal file
View File

@ -0,0 +1,16 @@
/*
* Any copyright is dedicated to the Public Domain.
* http://creativecommons.org/licenses/publicdomain/
*/
if ("evalcx" in this) {
var sandbox = evalcx("");
var obj = { get foo() { throw("FAIL"); } };
var getter = obj.__lookupGetter__("foo");
var desc = sandbox.Object.getOwnPropertyDescriptor(obj, "foo");
reportCompare(desc.get, getter, "getter is correct");
reportCompare(desc.set, undefined, "setter is correct");
}
else {
reportCompare(true, true);
}