Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-01-10 05:47:04 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix bug 454266 - js_FillPropertyCache uses the wrong scope's shape sometimes (r=mrbkap).

Browse Source
This commit is contained in:
Brendan Eich 2008-09-08 15:51:47 -07:00
parent ee3d4c3946
commit 5b1591656c
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
js/src/jsinterp.cpp
View File

@ -258,7 +258,7 @@ js_FillPropertyCache(JSContext *cx, JSObject *obj, jsuword kshape,
* but that is a one-time event and we'll have to miss the old shape and
* re-fill under the new one.
*/
if (!(cs->format & (JOF_SET | JOF_INCDEC)))
if (!(cs->format & (JOF_SET | JOF_INCDEC)) && obj == pobj)
kshape = scope->shape;
khash = PROPERTY_CACHE_HASH_PC(pc, kshape);

2
js/src/jstracer.cpp
View File

@ -3458,7 +3458,7 @@ TraceRecorder::test_property_cache_direct_slot(JSObject* obj, LIns* obj_ins, uin
return true;
}
/* Insist if setting on obj being the directly addressed object. */
/* If modifying the slot, insist on obj being the directly addressed object. */
uint32 setflags = (js_CodeSpec[*cx->fp->regs->pc].format & (JOF_SET | JOF_INCDEC));
if (setflags && obj2 != obj)
ABORT_TRACE("JOF_SET opcode hit prototype chain");