From e4341d9607bb34163ee8666eea120d5c10509df7 Mon Sep 17 00:00:00 2001 From: Benjamin Peterson Date: Tue, 25 Sep 2012 09:21:40 -0400 Subject: [PATCH] Bug 793513 - Only set properties on the rest array if it doesn't have unknown ones. r=jandem --- js/src/jsinfer.cpp | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp index 408696c83e0..a98b2cf61c7 100644 --- a/js/src/jsinfer.cpp +++ b/js/src/jsinfer.cpp @@ -3890,13 +3890,16 @@ ScriptAnalysis::analyzeTypesBytecode(JSContext *cx, unsigned offset, TypeObject *rest = TypeScript::InitObject(cx, script, pc, JSProto_Array); if (!rest) return false; - types->addType(cx, Type::ObjectType(rest)); // Simulate setting a element. - HeapTypeSet *propTypes = rest->getProperty(cx, JSID_VOID, true); - if (!propTypes) - return false; - propTypes->addType(cx, Type::UnknownType()); + if (!rest->unknownProperties()) { + HeapTypeSet *propTypes = rest->getProperty(cx, JSID_VOID, true); + if (!propTypes) + return false; + propTypes->addType(cx, Type::UnknownType()); + } + + types->addType(cx, Type::ObjectType(rest)); } else { types->addType(cx, Type::UnknownType()); }