Bug 870200 - Fix typeobject assignment to rest-argument arrays. r=bhackett

This commit is contained in:
Kannan Vijayan 2013-05-27 11:16:56 -04:00
parent 18fd56d251
commit d250d25570
4 changed files with 24 additions and 16 deletions

View File

@ -2468,12 +2468,6 @@ BEGIN_CASE(JSOP_REST)
if (!rest)
goto error;
PUSH_COPY(ObjectValue(*rest));
if (!SetInitializerObjectType(cx, script, regs.pc, rest, GenericObject))
goto error;
rootType0 = GetTypeCallerInitObject(cx, JSProto_Array);
if (!rootType0)
goto error;
rest->setType(rootType0);
}
END_CASE(JSOP_REST)

View File

@ -121,15 +121,6 @@ StackFrame::initVarsToUndefined()
SetValueRangeToUndefined(slots(), script()->nfixed);
}
inline JSObject *
StackFrame::createRestParameter(JSContext *cx)
{
JS_ASSERT(fun()->hasRest());
unsigned nformal = fun()->nargs - 1, nactual = numActualArgs();
unsigned nrest = (nactual > nformal) ? nactual - nformal : 0;
return NewDenseCopiedArray(cx, nrest, argv() + nformal, NULL);
}
inline Value &
StackFrame::unaliasedVar(unsigned i, MaybeCheckAliasing checkAliasing)
{

View File

@ -226,6 +226,29 @@ StackFrame::copyRawFrameSlots(AutoValueVector *vec)
return true;
}
JSObject *
StackFrame::createRestParameter(JSContext *cx)
{
JS_ASSERT(fun()->hasRest());
unsigned nformal = fun()->nargs - 1, nactual = numActualArgs();
unsigned nrest = (nactual > nformal) ? nactual - nformal : 0;
Value *restvp = actuals() + nformal;
RootedObject obj(cx, NewDenseCopiedArray(cx, nrest, restvp, NULL));
if (!obj)
return NULL;
RootedTypeObject type(cx, types::GetTypeCallerInitObject(cx, JSProto_Array));
if (!type)
return NULL;
obj->setType(type);
/* Ensure that values in the rest array are represented in the type of the array. */
for (unsigned i = 0; i < nrest; i++)
types::AddTypePropertyId(cx, obj, JSID_VOID, restvp[i]);
return obj;
}
static inline void
AssertDynamicScopeMatchesStaticScope(JSContext *cx, JSScript *script, JSObject *scope)
{

View File

@ -544,7 +544,7 @@ class StackFrame
ArgumentsObject &argsObj() const;
void initArgsObj(ArgumentsObject &argsobj);
inline JSObject *createRestParameter(JSContext *cx);
JSObject *createRestParameter(JSContext *cx);
/*
* Scope chain