From ad917b84e1b7cbc08232dfbf02520ccbff335949 Mon Sep 17 00:00:00 2001
From: Till Schneidereit <tschneidereit@gmail.com>
Date: Wed, 26 Jun 2013 17:00:24 +0200
Subject: [PATCH] Bug 885729 - Inline array and proxy specializations of
 js::DefineProperty into js::DefineProperties. r=jwalden

--HG--
extra : rebase_source : eaed8f6a1ba9a171c3d0d47641482b8d3273bd8d
---
 js/src/builtin/Object.cpp | 19 -------------------
 js/src/jsobj.cpp          | 34 ++++++++++++++++++++++++++++++----
 js/src/jsobj.h            |  3 +++
 3 files changed, 33 insertions(+), 23 deletions(-)

diff --git a/js/src/builtin/Object.cpp b/js/src/builtin/Object.cpp
index 3b8630d4615..d0a5eef9f69 100644
--- a/js/src/builtin/Object.cpp
+++ b/js/src/builtin/Object.cpp
@@ -23,25 +23,6 @@ using js::frontend::IsIdentifier;
 using mozilla::ArrayLength;
 
 
-// Duplicated in jsobj.cpp
-static bool
-DefineProperties(JSContext *cx, HandleObject obj, HandleObject props)
-{
-    AutoIdVector ids(cx);
-    AutoPropDescArrayRooter descs(cx);
-    if (!ReadPropertyDescriptors(cx, props, true, &ids, &descs))
-        return false;
-
-    bool dummy;
-    for (size_t i = 0, len = ids.length(); i < len; i++) {
-        if (!DefineProperty(cx, obj, ids.handleAt(i), descs[i], true, &dummy))
-            return false;
-    }
-
-    return true;
-}
-
-
 JSBool
 js::obj_construct(JSContext *cx, unsigned argc, Value *vp)
 {
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index d6280dfcb2f..04c0c62501a 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -1053,18 +1053,44 @@ js::ReadPropertyDescriptors(JSContext *cx, HandleObject props, bool checkAccesso
     return true;
 }
 
-// Duplicated in Object.cpp
-static bool
-DefineProperties(JSContext *cx, HandleObject obj, HandleObject props)
+bool
+js::DefineProperties(JSContext *cx, HandleObject obj, HandleObject props)
 {
     AutoIdVector ids(cx);
     AutoPropDescArrayRooter descs(cx);
     if (!ReadPropertyDescriptors(cx, props, true, &ids, &descs))
         return false;
 
+    if (obj->is<ArrayObject>()) {
+        bool dummy;
+        Rooted<ArrayObject*> arr(cx, &obj->as<ArrayObject>());
+        for (size_t i = 0, len = ids.length(); i < len; i++) {
+            if (!DefinePropertyOnArray(cx, arr, ids.handleAt(i), descs[i], true, &dummy))
+                return false;
+        }
+        return true;
+    }
+
+    if (obj->getOps()->lookupGeneric) {
+        /*
+         * FIXME: Once ScriptedIndirectProxies are removed, this code should call
+         * TrapDefineOwnProperty directly
+         */
+        if (obj->isProxy()) {
+            for (size_t i = 0, len = ids.length(); i < len; i++) {
+                RootedValue pd(cx, descs[i].pd());
+                if (!Proxy::defineProperty(cx, obj, ids.handleAt(i), pd))
+                    return false;
+            }
+            return true;
+        }
+        bool dummy;
+        return Reject(cx, obj, JSMSG_OBJECT_NOT_EXTENSIBLE, true, &dummy);
+    }
+
     bool dummy;
     for (size_t i = 0, len = ids.length(); i < len; i++) {
-        if (!DefineProperty(cx, obj, ids.handleAt(i), descs[i], true, &dummy))
+        if (!DefinePropertyOnObject(cx, obj, ids.handleAt(i), descs[i], true, &dummy))
             return false;
     }
 
diff --git a/js/src/jsobj.h b/js/src/jsobj.h
index 9d22ff79c1d..618b41705a5 100644
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -1316,6 +1316,9 @@ DefineProperty(JSContext *cx, js::HandleObject obj,
                js::HandleId id, const PropDesc &desc, bool throwError,
                bool *rval);
 
+bool
+DefineProperties(JSContext *cx, HandleObject obj, HandleObject props);
+
 /*
  * Read property descriptors from props, as for Object.defineProperties. See
  * ES5 15.2.3.7 steps 3-5.