Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-17 23:35:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1500255 - Handle objects with null prototype in stub-generator for oob array setelems. r=tcampbell

Browse Source
This commit is contained in:
Kannan Vijayan 2018-10-24 12:16:32 -04:00
parent 1f9d9c2fc3
commit 19377c4ab8
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
js/src/jit-test/tests/cacheir/bug1500255.js Normal file
View File

@ -0,0 +1,10 @@
setJitCompilerOption("offthread-compilation.enable", 0);
setJitCompilerOption("ion.warmup.trigger", 0);
foo();
function foo() {
Array.prototype.__proto__ = null;
Array.prototype[1] = 'bar';
}

4
js/src/jit/CacheIR.cpp
View File

@ -4093,7 +4093,9 @@ SetPropIRGenerator::tryAttachAddOrUpdateSparseElement(HandleObject obj, ObjOpera
}
// Indexed properties on the prototype chain aren't handled by the helper.
if (ObjectMayHaveExtraIndexedProperties(aobj->staticPrototype())) {
if ((aobj->staticPrototype() != nullptr) &&
ObjectMayHaveExtraIndexedProperties(aobj->staticPrototype()))
{
return false;
}