Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-08 04:27:37 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 868890 - Correctly generate barrier when accessing undefined properties of objects whose prototype also has the property, r=dvander.

Browse Source
This commit is contained in:
Brian Hackett 2013-05-08 17:25:24 -06:00
parent 0c06887eb0
commit 978dd1a882
1 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
js/src/ion/MIR.cpp
View File

@ -2420,13 +2420,16 @@ ion::PropertyReadNeedsTypeBarrier(JSContext *cx, types::TypeObject *object, Prop
if (!TypeSetIncludes(observed, MIRType_Value, property))
return true;
// Type information for global objects does not reflect the initial
// 'undefined' value of variables declared with 'var'. Until the variable
// is assigned a value other than undefined, a barrier is required.
if (property->empty() && name && object->singleton && object->singleton->isNative()) {
// Type information for singleton objects is not required to reflect the
// initial 'undefined' value for native properties, in particular global
// variables declared with 'var'. Until the property is assigned a value
// other than undefined, a barrier is required.
if (name && object->singleton && object->singleton->isNative()) {
Shape *shape = object->singleton->nativeLookup(cx, name);
if (shape && shape->hasDefaultGetter()) {
JS_ASSERT(object->singleton->nativeGetSlot(shape->slot()).isUndefined());
if (shape &&
shape->hasDefaultGetter() &&
object->singleton->nativeGetSlot(shape->slot()).isUndefined())
{
return true;
}
}