wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 876098. Make sure to not skip calling addProperty hooks when objects have them. Otherwise DOM expandos can go AWOL. r=djvj

Browse Source
This commit is contained in:
Boris Zbarsky 2013-05-30 13:01:38 -04:00
parent 2fed6153d1
commit b028163812
3 changed files with 58 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
dom/tests/mochitest/bugs/Makefile.in
View File

@ -145,6 +145,7 @@ MOCHITEST_FILES = \
test_resize_move_windows.html \
test_bug862540.html \
test_bug857555.html \
test_bug876098.html \
$(NULL)
include $(topsrcdir)/config/rules.mk

52
dom/tests/mochitest/bugs/test_bug876098.html Normal file
View File

@ -0,0 +1,52 @@
<!DOCTYPE HTML>
<html>
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=876098
-->
<head>
<meta charset="utf-8">
<title>Test for Bug 876098</title>
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
<script type="application/javascript">
/** Test for Bug 876098 **/
var div = document.createElement("div");
// count has to be large enough to trigger ion-compilation
var count = 2000;
// Separate function to make sure nothing weird we do block the ion-compile
(function() {
for (var i = 0; i < count; ++i) {
var span = document.createElement("span");
span.x = "foo";
div.appendChild(span);
}
})();
SpecialPowers.gc();
function allHaveProp() {
var kids = div.childNodes;
for (var i = 0; i < count; ++i) {
if (kids[i].x != "foo") {
return false;
}
}
return true;
}
ok(allHaveProp(), "All spans should have the property we added");
</script>
</head>
<body>
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=876098">Mozilla Bug 876098</a>
<p id="display"></p>
<div id="content" style="display: none">
</div>
<pre id="test">
</pre>
</body>
</html>

5
js/src/ion/IonCaches.cpp
View File

@ -2057,6 +2057,11 @@ IsPropertyAddInlineable(JSContext *cx, HandleObject obj, HandleId id, uint32_t o
if (obj->getClass()->resolve != JS_ResolveStub)
return false;
// Likewise for a non-default addProperty hook, since we'll need
// to invoke it.
if (obj->getClass()->addProperty != JS_PropertyStub)
return false;
if (!obj->isExtensible() || !shape->writable())
return false;