Bug 533258 - "Assertion failure: hasMethodBarrier()" with ckeditor (r=jorendorff).

This commit is contained in:
Brendan Eich 2010-01-07 10:01:01 -08:00
parent 51056b237b
commit f22c353c9c
3 changed files with 12 additions and 5 deletions

View File

@ -1138,6 +1138,7 @@ JSScope::newDictionaryProperty(JSContext *cx, const JSScopeProperty &child,
dprop->childp = NULL;
insertDictionaryProperty(dprop, childp);
updateFlags(dprop);
return dprop;
}

View File

@ -257,6 +257,7 @@ struct JSScope : public JSObjectMap
/* Defined in jsscopeinlines.h to avoid including implementation dependencies here. */
inline void updateShape(JSContext *cx);
inline void updateFlags(const JSScopeProperty *sprop);
void initMinimal(JSContext *cx, uint32 newShape);
bool createTable(JSContext *cx, bool report);

View File

@ -56,12 +56,8 @@ JSScope::updateShape(JSContext *cx)
}
inline void
JSScope::extend(JSContext *cx, JSScopeProperty *sprop)
JSScope::updateFlags(const JSScopeProperty *sprop)
{
++entryCount;
setLastProperty(sprop);
updateShape(cx);
jsuint index;
if (js_IdIsIndex(sprop->id, &index))
setIndexedProperties();
@ -70,6 +66,15 @@ JSScope::extend(JSContext *cx, JSScopeProperty *sprop)
setMethodBarrier();
}
inline void
JSScope::extend(JSContext *cx, JSScopeProperty *sprop)
{
++entryCount;
setLastProperty(sprop);
updateShape(cx);
updateFlags(sprop);
}
/*
* Property read barrier for deferred cloning of compiler-created function
* objects optimized as typically non-escaping, ad-hoc methods in obj.