Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-02-24 03:19:06 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Backed out changeset 617081e0fdf5 (bug 667047) for possible orange

Browse Source
This commit is contained in:
Michael Wu 2011-08-01 22:46:17 -07:00
parent 57c3ed0aec
commit 39b9344e26
3 changed files with 11 additions and 49 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
js/src/jstypedarray.cpp
View File

@ -300,42 +300,24 @@ ArrayBuffer::obj_setProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp, J
return true;
if (JSID_IS_ATOM(id, cx->runtime->atomState.protoAtom)) {
// setting __proto__ = null
// effectively removes the prototype chain.
// any attempt to set __proto__ on native
// objects after setting them to null makes
// __proto__ just a plain property.
// the following code simulates this behaviour on arrays.
//
// we first attempt to set the prototype on
// the delegate which is a native object
// so that existing code handles the case
// of treating it as special or plain.
// if the delegate's prototype has now changed
// then we change our prototype too.
//
// otherwise __proto__ was a plain property
// and we don't modify our prototype chain
// since obj_getProperty will fetch it as a plain
// property from the delegate.
if (!vp->isObjectOrNull())
return JS_TRUE;
JSObject *pobj = vp->toObjectOrNull();
JSObject *delegate = DelegateObject(cx, obj);
if (!delegate)
return false;
// save the old prototype
JSObject *oldDelegateProto = delegate->getProto();
if (!js_SetProperty(cx, delegate, id, vp, strict))
if (!SetProto(cx, delegate, pobj, true))
return false;
if (delegate->getProto() != oldDelegateProto) {
// actual __proto__ was set and not a plain property called
// __proto__
if (!SetProto(cx, obj, vp->toObjectOrNull(), true)) {
// this can be caused for example by setting x.__proto__ = x
// restore delegate prototype chain
delegate->setProto(oldDelegateProto);
return false;
}
if (!SetProto(cx, obj, pobj, true)) {
// restore proto on delegate
JS_ALWAYS_TRUE(SetProto(cx, delegate, oldDelegateProto, true));
return false;
}
return true;
}

1
js/src/tests/js1_8_5/regress/jstests.list
View File

@ -107,5 +107,4 @@ script regress-646820-3.js
script regress-643222.js
script regress-614714.js
script regress-665355.js
script regress-667047.js
script regress-666599.js

19
js/src/tests/js1_8_5/regress/regress-667047.js
View File

@ -1,19 +0,0 @@
var x = new ArrayBuffer();
// first set to null should make the proto chain undefined
x.__proto__ = null;
assertEq(x.__proto__, undefined);
// second set makes it a property
x.__proto__ = null;
assertEq(x.__proto__, null);
// always act as a property now
x.__proto__ = {a:2};
assertEq(x.__proto__.a, 2);
assertEq(x.a, undefined);
var ab = new ArrayBuffer();
// not the same as setting __proto__ to null
ab.__proto__ = Object.create(null);
ab.__proto__ = {a:2};
// should still act like __proto__ is a plain property
assertEq(ab.a, undefined);
reportCompare(true, true);