Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-28 23:31:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1825907 - Remove unnecessary property iterator in ArgumentsObject::setElement. r=jonco

Browse Source 
This was leftover from TI when we needed this loop to look up the `PropertyKey`.

Differential Revision: https://phabricator.services.mozilla.com/D174716
This commit is contained in:
Jan de Mooij 2023-04-05 08:15:46 +00:00
parent a3621a085f
commit 169e55791f
2 changed files with 10 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
js/src/jit-test/tests/arguments/bug1825907.js Normal file
View File

@ -0,0 +1,7 @@
function f(arg) {
eval(`var y = 1; function f() {return y}; f();`);
delete y;
arguments[0] = 5;
assertEq(arg, 5);
}
f(0);

13
js/src/vm/ArgumentsObject-inl.h
View File

@ -30,19 +30,12 @@ inline void ArgumentsObject::setElement(uint32_t i, const Value& v) {
MOZ_ASSERT(isElement(i));
GCPtr<Value>& lhs = data()->args[i];
if (IsMagicScopeSlotValue(lhs)) {
uint32_t slot = SlotFromMagicScopeSlotValue(lhs);
CallObject& callobj =
getFixedSlot(MAYBE_CALL_SLOT).toObject().as<CallObject>();
for (SharedShapePropertyIter<NoGC> iter(callobj.sharedShape());
!iter.done(); iter++) {
if (iter->slot() == slot) {
callobj.setAliasedFormalFromArguments(lhs, v);
return;
}
}
MOZ_CRASH("Bad Arguments::setElement");
callobj.setAliasedFormalFromArguments(lhs, v);
} else {
lhs = v;
}
lhs = v;
}
inline bool ArgumentsObject::maybeGetElements(uint32_t start, uint32_t count,