wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Properly watch for indexed prototypes and configured properties in array prototype, bug 709067. r=luke

Browse Source
This commit is contained in:
Brian Hackett 2011-12-15 08:51:09 -08:00
parent 8fbe02a1f8
commit 788d4d29a6
2 changed files with 23 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
js/src/jit-test/tests/jaeger/bug709067.js Normal file
View File

@ -0,0 +1,11 @@
called = 0;
Object.defineProperty(Object.prototype, 0, {set: function() { called++; }});
function testInit()
{
var a = [];
for (var i = 0; i < 5; i++)
a[i] = 0;
}
for (var i = 0; i < 100; i++)
testInit();
assertEq(called, 100);

22
js/src/methodjit/Compiler.cpp
View File

@ -7702,17 +7702,19 @@ mjit::Compiler::arrayPrototypeHasIndexedProperty()
JSObject *proto;
if (!js_GetClassPrototype(cx, NULL, JSProto_Array, &proto, NULL))
return false;
/*
* It is sufficient to check just Array.prototype; if Object.prototype is
* unknown or has an indexed property, those will be reflected in
* Array.prototype.
*/
if (proto->getType(cx)->unknownProperties())
return true;
types::TypeSet *arrayTypes = proto->getType(cx)->getProperty(cx, JSID_VOID, false);
return !arrayTypes || arrayTypes->knownNonEmpty(cx);
while (proto) {
types::TypeObject *type = proto->getType(cx);
if (type->unknownProperties())
return true;
types::TypeSet *indexTypes = type->getProperty(cx, JSID_VOID, false);
if (!indexTypes || indexTypes->isOwnProperty(cx, type, true) || indexTypes->knownNonEmpty(cx))
return true;
proto = proto->getProto();
}
return false;
}
/*