diff --git a/js/src/jit-test/tests/basic/bug769433.js b/js/src/jit-test/tests/basic/bug769433.js new file mode 100644 index 00000000000..3eefcaa5bf4 --- /dev/null +++ b/js/src/jit-test/tests/basic/bug769433.js @@ -0,0 +1,8 @@ + +function stringConvert() { + var a = Uint32Array.prototype; + for (var i = 0; i < 10; i++) { + a[0] = i; + } +} +stringConvert(); diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp index 457af5a3b79..a09cbb5aa09 100644 --- a/js/src/jsinfer.cpp +++ b/js/src/jsinfer.cpp @@ -5584,9 +5584,17 @@ JSObject::makeLazyType(JSContext *cx) if (getClass()->ext.equality) type->flags |= OBJECT_FLAG_SPECIAL_EQUALITY; + /* + * Adjust flags for objects which will have the wrong flags set by just + * looking at the class prototype key. + */ + if (isSlowArray()) type->flags |= OBJECT_FLAG_NON_DENSE_ARRAY | OBJECT_FLAG_NON_PACKED_ARRAY; + if (IsTypedArrayProto(this)) + type->flags |= OBJECT_FLAG_NON_TYPED_ARRAY; + type_ = type; }