mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-10-21 09:15:35 +00:00
Bug 1182865 - Relax assertion on the allowed class for home objects, r=efaust
This commit is contained in:
parent
5d630742c6
commit
636412d090
8
js/src/jit-test/tests/basic/bug1182865.js
Normal file
8
js/src/jit-test/tests/basic/bug1182865.js
Normal file
@ -0,0 +1,8 @@
|
||||
|
||||
for (var j = 0; j < 99; j++) {
|
||||
Array[{
|
||||
f() {
|
||||
eval()
|
||||
}
|
||||
}];
|
||||
}
|
@ -4040,9 +4040,9 @@ CASE(JSOP_INITHOMEOBJECT)
|
||||
MOZ_ASSERT(func->allowSuperProperty());
|
||||
|
||||
/* Load the home object */
|
||||
ReservedRooted<NativeObject*> obj(&rootNativeObject0);
|
||||
obj = ®S.sp[int(-2 - skipOver)].toObject().as<NativeObject>();
|
||||
MOZ_ASSERT(obj->is<PlainObject>() || obj->is<JSFunction>());
|
||||
ReservedRooted<JSObject*> obj(&rootObject0);
|
||||
obj = ®S.sp[int(-2 - skipOver)].toObject();
|
||||
MOZ_ASSERT(obj->is<PlainObject>() || obj->is<UnboxedPlainObject>() || obj->is<JSFunction>());
|
||||
|
||||
func->setExtendedSlot(FunctionExtended::METHOD_HOMEOBJECT_SLOT, ObjectValue(*obj));
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user