mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
Watch for typed array prototypes when making filling in type information for singletons, bug 769433. r=dvander
This commit is contained in:
parent
729414cc16
commit
fc9d1ddbfb
8
js/src/jit-test/tests/basic/bug769433.js
Normal file
8
js/src/jit-test/tests/basic/bug769433.js
Normal file
@ -0,0 +1,8 @@
|
||||
|
||||
function stringConvert() {
|
||||
var a = Uint32Array.prototype;
|
||||
for (var i = 0; i < 10; i++) {
|
||||
a[0] = i;
|
||||
}
|
||||
}
|
||||
stringConvert();
|
@ -5584,9 +5584,17 @@ JSObject::makeLazyType(JSContext *cx)
|
||||
if (getClass()->ext.equality)
|
||||
type->flags |= OBJECT_FLAG_SPECIAL_EQUALITY;
|
||||
|
||||
/*
|
||||
* Adjust flags for objects which will have the wrong flags set by just
|
||||
* looking at the class prototype key.
|
||||
*/
|
||||
|
||||
if (isSlowArray())
|
||||
type->flags |= OBJECT_FLAG_NON_DENSE_ARRAY | OBJECT_FLAG_NON_PACKED_ARRAY;
|
||||
|
||||
if (IsTypedArrayProto(this))
|
||||
type->flags |= OBJECT_FLAG_NON_TYPED_ARRAY;
|
||||
|
||||
type_ = type;
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user