wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

[INFER] Backout 3a8b5e4a286b for suspected M-oth orange.

Browse Source
This commit is contained in:
Brian Hackett 2011-09-16 20:31:54 -07:00
parent 4cd2135ba9
commit f2651fd01e
2 changed files with 28 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
js/src/jit-test/tests/basic/bug683140.js
View File

@ -1,13 +0,0 @@
var g = newGlobal("same-compartment");
g.eval("this.f = function(a) {" +
"assertEq(a instanceof Array, false);" +
"a = Array.prototype.slice.call(a);" +
"assertEq(a instanceof Array, true); }");
g.f([1, 2, 3]);
var g2 = newGlobal("new-compartment");
g2.a = g2.Array(10);
assertEq(g2.a instanceof Array, false);
g2.a = Array.prototype.slice(g2.a);
assertEq(g2.a instanceof Array, true);

47
js/src/jsarray.cpp
View File

@ -2615,21 +2615,6 @@ array_unshift(JSContext *cx, uintN argc, Value *vp)
return JS_TRUE;
}
static inline void
TryReuseArrayType(JSObject *obj, JSObject *nobj)
{
/*
* Try to change the type of a newly created array nobj to the same type
* as obj. This can only be performed if the original object is an array
* and has the same prototype.
*/
JS_ASSERT(nobj->isDenseArray());
JS_ASSERT(nobj->type() == nobj->getProto()->newType);
if (obj->isArray() && !obj->hasSingletonType() && obj->getProto() == nobj->getProto())
nobj->setType(obj->type());
}
static JSBool
array_splice(JSContext *cx, uintN argc, Value *vp)
{
@ -2640,11 +2625,24 @@ array_splice(JSContext *cx, uintN argc, Value *vp)
jsuint length, begin, end, count, delta, last;
JSBool hole;
/*
* Get the type of the result object: the original type when splicing an
* array, a generic array type otherwise.
*/
TypeObject *type;
if (obj->isArray() && !obj->hasSingletonType()) {
type = obj->type();
} else {
type = GetTypeNewObject(cx, JSProto_Array);
if (!type)
return false;
}
/* Create a new array value to return. */
JSObject *obj2 = NewDenseEmptyArray(cx);
if (!obj2)
return JS_FALSE;
TryReuseArrayType(obj, obj2);
obj2->setType(type);
vp->setObject(*obj2);
/* Nothing to do if no args. Otherwise get length. */
@ -2803,7 +2801,8 @@ array_concat(JSContext *cx, uintN argc, Value *vp)
nobj = NewDenseCopiedArray(cx, initlen, vector);
if (!nobj)
return JS_FALSE;
TryReuseArrayType(aobj, nobj);
if (nobj->getProto() == aobj->getProto() && !aobj->hasSingletonType())
nobj->setType(aobj->type());
nobj->setArrayLength(cx, length);
if (!aobj->isPackedDenseArray())
nobj->markDenseArrayNotPacked(cx);
@ -2906,12 +2905,22 @@ array_slice(JSContext *cx, uintN argc, Value *vp)
if (begin > end)
begin = end;
/* Get the type object for the returned array, as for array_splice. */
TypeObject *type;
if (obj->isArray() && !obj->hasSingletonType()) {
type = obj->type();
} else {
type = GetTypeNewObject(cx, JSProto_Array);
if (!type)
return false;
}
if (obj->isDenseArray() && end <= obj->getDenseArrayInitializedLength() &&
!js_PrototypeHasIndexedProperties(cx, obj)) {
nobj = NewDenseCopiedArray(cx, end - begin, obj->getDenseArrayElements() + begin);
if (!nobj)
return JS_FALSE;
TryReuseArrayType(obj, nobj);
nobj->setType(type);
if (!obj->isPackedDenseArray())
nobj->markDenseArrayNotPacked(cx);
vp->setObject(*nobj);
@ -2922,7 +2931,7 @@ array_slice(JSContext *cx, uintN argc, Value *vp)
nobj = NewDenseAllocatedArray(cx, end - begin);
if (!nobj)
return JS_FALSE;
TryReuseArrayType(obj, nobj);
nobj->setType(type);
vp->setObject(*nobj);
AutoValueRooter tvr(cx);