wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Avoid assert botch when adding properties to objects, bug 684505.

Browse Source
This commit is contained in:
Brian Hackett 2011-09-29 20:46:33 -07:00
parent 7ac1c16082
commit 7e3df0c914
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
js/src/jsscope.cpp
View File

@ -642,7 +642,7 @@ JSObject::addPropertyInternal(JSContext *cx, jsid id,
bool stableSlot =
(slot == SHAPE_INVALID_SLOT) ||
lastProp->hasMissingSlot() ||
(slot == lastProp->slot() + 1);
(slot == lastProp->maybeSlot() + 1);
JS_ASSERT_IF(!allowDictionary, stableSlot);
if (allowDictionary &&
(!stableSlot || lastProp->entryCount() >= PropertyTree::MAX_HEIGHT)) {