wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 1155292 - Add a check for properties found on non-native prototypes during Ion caching, r=jandem.

Browse Source
This commit is contained in:
Brian Hackett 2015-04-28 08:15:20 -07:00
parent cdc7b8a3b2
commit a73ca09dd5
2 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
js/src/jit-test/tests/ion/bug1155292.js Normal file
View File

@ -0,0 +1,13 @@
// |jit-test| error: InternalError
new Function(`
var TO = TypedObject;
var PointType = new TO.StructType({x: TO.int32, y: TO.int32 });
function testPoint() {
var p = new PointType();
var sub = Object.create(p);
sub.x = 5;
anonymous('minEmptyChunkCount')
}
testPoint();
`)();

5
js/src/jit/IonCaches.cpp
View File

@ -3041,8 +3041,11 @@ CanAttachNativeSetProp(JSContext* cx, HandleObject obj, HandleId id, ConstantOrR
// a stub to add the property until we do the VM call to add. If the
// property exists as a data property on the prototype, we should add
// a new, shadowing property.
if (obj->isNative() && (!shape || (obj != holder && shape->hasDefaultSetter() && shape->hasSlot())))
if (obj->isNative() && (!shape || (obj != holder && holder->isNative() &&
shape->hasDefaultSetter() && shape->hasSlot())))
{
return SetPropertyIC::MaybeCanAttachAddSlot;
}
if (IsImplicitNonNativeProperty(shape))
return SetPropertyIC::CanAttachNone;