mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-10-16 23:05:42 +00:00
Merge tracemonkey to mozilla-central a=blockers.
This commit is contained in:
commit
bf97b8752b
18
dom/base/crashtests/603531.html
Normal file
18
dom/base/crashtests/603531.html
Normal file
@ -0,0 +1,18 @@
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<script>
|
||||
|
||||
function boom()
|
||||
{
|
||||
var frame = document.getElementById("f");
|
||||
var frameWindow = frame.contentWindow;
|
||||
document.body.removeChild(frame);
|
||||
document.body.setUserData("x", frameWindow, null);
|
||||
document.body.setUserData("x", "", null);
|
||||
}
|
||||
|
||||
</script>
|
||||
</head>
|
||||
<body onload="boom();"><iframe id="f" src="data:text/html,"></iframe></body>
|
||||
</html>
|
@ -22,4 +22,5 @@ load 499006-1.html
|
||||
load 499006-2.html
|
||||
load 502617.html
|
||||
asserts(1) load 504224.html # bug 564098
|
||||
load 603531.html
|
||||
load 601247.html
|
||||
|
@ -4293,13 +4293,13 @@ BEGIN_CASE(JSOP_SETMETHOD)
|
||||
JSAtom *atom;
|
||||
if (cache->testForSet(cx, regs.pc, obj, &entry, &obj2, &atom)) {
|
||||
/*
|
||||
* Fast property cache hit, only partially confirmed by
|
||||
* testForSet. We know that the entry applies to regs.pc and
|
||||
* that obj's shape matches.
|
||||
* Property cache hit, only partially confirmed by testForSet. We
|
||||
* know that the entry applies to regs.pc and that obj's shape
|
||||
* matches.
|
||||
*
|
||||
* The entry predicts either a new property to be added
|
||||
* directly to obj by this set, or on an existing "own"
|
||||
* property, or on a prototype property that has a setter.
|
||||
* The entry predicts either a new property to be added directly to
|
||||
* obj by this set, or on an existing "own" property, or on a
|
||||
* prototype property that has a setter.
|
||||
*/
|
||||
const Shape *shape = entry->vword.toShape();
|
||||
JS_ASSERT_IF(shape->isDataDescriptor(), shape->writable());
|
||||
@ -4382,26 +4382,12 @@ BEGIN_CASE(JSOP_SETMETHOD)
|
||||
}
|
||||
}
|
||||
PCMETER(cache->setpcmisses++);
|
||||
atom = NULL;
|
||||
} else if (!atom) {
|
||||
/*
|
||||
* Slower property cache hit, fully confirmed by testForSet (in the
|
||||
* slow path, via fullTest).
|
||||
*/
|
||||
ASSERT_VALID_PROPERTY_CACHE_HIT(0, obj, obj2, entry);
|
||||
const Shape *shape = NULL;
|
||||
if (obj == obj2) {
|
||||
shape = entry->vword.toShape();
|
||||
JS_ASSERT(shape->writable());
|
||||
JS_ASSERT(obj2->isExtensible());
|
||||
NATIVE_SET(cx, obj, shape, entry, &rval);
|
||||
}
|
||||
if (shape)
|
||||
break;
|
||||
|
||||
LOAD_ATOM(0, atom);
|
||||
} else {
|
||||
JS_ASSERT(atom);
|
||||
}
|
||||
|
||||
if (!atom)
|
||||
LOAD_ATOM(0, atom);
|
||||
jsid id = ATOM_TO_JSID(atom);
|
||||
if (entry && JS_LIKELY(!obj->getOps()->setProperty)) {
|
||||
uintN defineHow;
|
||||
|
@ -1697,10 +1697,8 @@ js_NewPropertyDescriptorObject(JSContext *cx, jsid id, uintN attrs,
|
||||
JSBool
|
||||
js_GetOwnPropertyDescriptor(JSContext *cx, JSObject *obj, jsid id, Value *vp)
|
||||
{
|
||||
if (obj->isProxy()) {
|
||||
if (!JSProxy::getOwnPropertyDescriptor(cx, obj, id, false, vp))
|
||||
return false;
|
||||
}
|
||||
if (obj->isProxy())
|
||||
return JSProxy::getOwnPropertyDescriptor(cx, obj, id, false, vp);
|
||||
|
||||
JSObject *pobj;
|
||||
JSProperty *prop;
|
||||
|
@ -236,11 +236,7 @@ class PropertyCache
|
||||
/*
|
||||
* Test for cached information about a property set on *objp at pc.
|
||||
*
|
||||
* On a fast hit, set *entryp to the entry and return true.
|
||||
*
|
||||
* On a slow hit, set *entryp to the entry, set *obj2p to the object that
|
||||
* owns the property (either obj or a prototype), set *atomp to NULL, and
|
||||
* return false.
|
||||
* On a hit, set *entryp to the entry and return true.
|
||||
*
|
||||
* On a miss, set *atomp to the name of the property being set and return false.
|
||||
*/
|
||||
|
@ -115,16 +115,12 @@ PropertyCache::testForSet(JSContext *cx, jsbytecode *pc, JSObject *obj,
|
||||
if (entry->kpc == pc && entry->kshape == shape)
|
||||
return true;
|
||||
|
||||
#ifdef DEBUG
|
||||
JSObject *orig = obj;
|
||||
#endif
|
||||
JSAtom *atom = fullTest(cx, pc, &obj, obj2p, entry);
|
||||
if (atom) {
|
||||
PCMETER(misses++);
|
||||
PCMETER(setmisses++);
|
||||
} else {
|
||||
JS_ASSERT(obj == orig);
|
||||
}
|
||||
JS_ASSERT(atom);
|
||||
|
||||
PCMETER(misses++);
|
||||
PCMETER(setmisses++);
|
||||
|
||||
*atomp = atom;
|
||||
return false;
|
||||
}
|
||||
|
@ -153,13 +153,13 @@ stubs::SetName(VMFrame &f, JSAtom *origAtom)
|
||||
JSAtom *atom;
|
||||
if (cache->testForSet(cx, f.regs.pc, obj, &entry, &obj2, &atom)) {
|
||||
/*
|
||||
* Fast property cache hit, only partially confirmed by
|
||||
* testForSet. We know that the entry applies to regs.pc and
|
||||
* that obj's shape matches.
|
||||
* Property cache hit, only partially confirmed by testForSet. We
|
||||
* know that the entry applies to regs.pc and that obj's shape
|
||||
* matches.
|
||||
*
|
||||
* The entry predicts either a new property to be added
|
||||
* directly to obj by this set, or on an existing "own"
|
||||
* property, or on a prototype property that has a setter.
|
||||
* The entry predicts either a new property to be added directly to
|
||||
* obj by this set, or on an existing "own" property, or on a
|
||||
* prototype property that has a setter.
|
||||
*/
|
||||
const Shape *shape = entry->vword.toShape();
|
||||
JS_ASSERT_IF(shape->isDataDescriptor(), shape->writable());
|
||||
@ -241,25 +241,12 @@ stubs::SetName(VMFrame &f, JSAtom *origAtom)
|
||||
}
|
||||
}
|
||||
PCMETER(cache->setpcmisses++);
|
||||
atom = NULL;
|
||||
} else if (!atom) {
|
||||
/*
|
||||
* Slower property cache hit, fully confirmed by testForSet (in the
|
||||
* slow path, via fullTest).
|
||||
*/
|
||||
const Shape *shape = NULL;
|
||||
if (obj == obj2) {
|
||||
shape = entry->vword.toShape();
|
||||
JS_ASSERT(shape->writable());
|
||||
JS_ASSERT(obj2->isExtensible());
|
||||
NATIVE_SET(cx, obj, shape, entry, &rval);
|
||||
}
|
||||
if (shape)
|
||||
break;
|
||||
|
||||
atom = origAtom;
|
||||
} else {
|
||||
JS_ASSERT(atom);
|
||||
}
|
||||
|
||||
if (!atom)
|
||||
atom = origAtom;
|
||||
jsid id = ATOM_TO_JSID(atom);
|
||||
if (entry && JS_LIKELY(!obj->getOps()->setProperty)) {
|
||||
uintN defineHow;
|
||||
|
@ -7,3 +7,4 @@ script String-toSource.js
|
||||
script proxy-strict.js
|
||||
script regress-bug567606.js
|
||||
script string-literal-getter-setter-decompilation.js
|
||||
script regress-bug607284.js
|
||||
|
16
js/src/tests/ecma_5/extensions/regress-bug607284.js
Normal file
16
js/src/tests/ecma_5/extensions/regress-bug607284.js
Normal file
@ -0,0 +1,16 @@
|
||||
/*
|
||||
* Any copyright is dedicated to the Public Domain.
|
||||
* http://creativecommons.org/licenses/publicdomain/
|
||||
*/
|
||||
|
||||
if ("evalcx" in this) {
|
||||
var sandbox = evalcx("");
|
||||
var obj = { get foo() { throw("FAIL"); } };
|
||||
var getter = obj.__lookupGetter__("foo");
|
||||
var desc = sandbox.Object.getOwnPropertyDescriptor(obj, "foo");
|
||||
reportCompare(desc.get, getter, "getter is correct");
|
||||
reportCompare(desc.set, undefined, "setter is correct");
|
||||
}
|
||||
else {
|
||||
reportCompare(true, true);
|
||||
}
|
Loading…
Reference in New Issue
Block a user