wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Watch for typed array prototypes when making filling in type information for singletons, bug 769433. r=dvander

Browse Source
This commit is contained in:
Brian Hackett 2012-06-29 12:27:09 -07:00
parent 729414cc16
commit fc9d1ddbfb
2 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
js/src/jit-test/tests/basic/bug769433.js Normal file
View File

@ -0,0 +1,8 @@
function stringConvert() {
var a = Uint32Array.prototype;
for (var i = 0; i < 10; i++) {
a[0] = i;
}
}
stringConvert();

8
js/src/jsinfer.cpp
View File

@ -5584,9 +5584,17 @@ JSObject::makeLazyType(JSContext *cx)
if (getClass()->ext.equality)
type->flags |= OBJECT_FLAG_SPECIAL_EQUALITY;
/*
* Adjust flags for objects which will have the wrong flags set by just
* looking at the class prototype key.
*/
if (isSlowArray())
type->flags |= OBJECT_FLAG_NON_DENSE_ARRAY | OBJECT_FLAG_NON_PACKED_ARRAY;
if (IsTypedArrayProto(this))
type->flags |= OBJECT_FLAG_NON_TYPED_ARRAY;
type_ = type;
}