Bug 793513 - Only set properties on the rest array if it doesn't have unknown ones. r=jandem

This commit is contained in:
Benjamin Peterson 2012-09-25 09:21:40 -04:00
parent 1b0639f560
commit e4341d9607

View File

@ -3890,13 +3890,16 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset,
TypeObject *rest = TypeScript::InitObject(cx, script, pc, JSProto_Array);
if (!rest)
return false;
types->addType(cx, Type::ObjectType(rest));
// Simulate setting a element.
HeapTypeSet *propTypes = rest->getProperty(cx, JSID_VOID, true);
if (!propTypes)
return false;
propTypes->addType(cx, Type::UnknownType());
if (!rest->unknownProperties()) {
HeapTypeSet *propTypes = rest->getProperty(cx, JSID_VOID, true);
if (!propTypes)
return false;
propTypes->addType(cx, Type::UnknownType());
}
types->addType(cx, Type::ObjectType(rest));
} else {
types->addType(cx, Type::UnknownType());
}