Bug 764148 - Stop incorrectly shadowing TI properties on sets if a setter would

be called. r=bhackett
This commit is contained in:
Eric Faust 2012-06-25 17:32:34 -07:00
parent 24d673a03c
commit d683c3b5f2

View File

@ -1260,8 +1260,36 @@ TypeObject::getProperty(JSContext *cx, jsid id, bool assign)
TypeSet *types = &(*pprop)->types;
if (assign)
types->setOwnProperty(cx, false);
if (assign && !types->isOwnProperty(false)) {
/*
* Normally, we just want to set the property as being an own property
* when we got a set to it. The exception is when the set is actually
* calling a setter higher on the prototype chain. Check to see if there
* is a setter higher on the prototype chain, setter the property as an
* own property if that is not the case.
*/
bool foundSetter = false;
JSObject *protoWalk = proto;
while (protoWalk) {
if (!protoWalk->isNative()) {
protoWalk = protoWalk->getProto();
continue;
}
const Shape *shape = protoWalk->nativeLookup(cx, id);
foundSetter = shape &&
!shape->hasDefaultSetter();
if (foundSetter)
break;
protoWalk = protoWalk->getProto();
}
if (!foundSetter)
types->setOwnProperty(cx, false);
}
return types;
}