Must set initial slot value in js_DefineNativeProperty via write barrier (417012, r=shaver).

This commit is contained in:
brendan@mozilla.org 2008-02-13 19:12:44 -08:00
parent 0e3a3d85ad
commit d2a6517917

View File

@ -2958,7 +2958,7 @@ js_DefineProperty(JSContext *cx, JSObject *obj, jsid id, jsval value,
} \
if (*(vp) != nominal_) { \
if (SPROP_HAS_VALID_SLOT(sprop, scope)) \
LOCKED_OBJ_SET_SLOT(obj, (sprop)->slot, *(vp)); \
LOCKED_OBJ_WRITE_BARRIER(cx, obj, (sprop)->slot, *(vp)); \
} \
} \
JS_END_MACRO
@ -3053,7 +3053,7 @@ js_DefineNativeProperty(JSContext *cx, JSObject *obj, jsid id, jsval value,
/* Store value before calling addProperty, in case the latter GC's. */
if (SPROP_HAS_VALID_SLOT(sprop, scope))
LOCKED_OBJ_SET_SLOT(obj, sprop->slot, value);
LOCKED_OBJ_WRITE_BARRIER(cx, obj, sprop->slot, value);
/* XXXbe called with lock held */
ADD_PROPERTY_HELPER(cx, clasp, obj, scope, sprop, &value,