Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-02-06 22:53:08 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix assert, bug 595921. r=dmandelin

Browse Source
This commit is contained in:
Brian Hackett 2010-09-14 14:28:55 -07:00
parent be8ddc93fe
commit dfdfb5e887
2 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
js/src/methodjit/PolyIC.cpp
View File

@ -562,6 +562,15 @@ class SetPropCompiler : public PICStubCompiler
if (obj->sealed())
return disable("sealed");
Class *clasp = obj->getClass();
if (clasp->setProperty != PropertyStub)
return disable("set property hook");
if (clasp->ops.lookupProperty)
return disable("ops lookup property hook");
if (clasp->ops.setProperty)
return disable("ops set property hook");
#ifdef JS_THREADSAFE
if (!CX_OWNS_OBJECT_TITLE(f.cx, obj))
return disable("shared object");
@ -601,10 +610,10 @@ class SetPropCompiler : public PICStubCompiler
if (obj->isDelegate())
return disable("delegate");
Class *clasp = obj->getClass();
if (clasp->addProperty != PropertyStub)
return disable("add property hook");
if (clasp->ops.defineProperty)
return disable("ops define property hook");
uint32 index;
if (js_IdIsIndex(id, &index))

9
js/src/trace-test/tests/jaeger/bug595921.js Normal file
View File

@ -0,0 +1,9 @@
/* Don't assert. */
x = <x/>
function f(aaa) {
aaa.e = x
}
for each(let c in [x, x, x]) {
f(c)
}
assertEq(0,0);