зеркало из https://github.com/mozilla/gecko-dev.git
fun->u.i.names is incorrect when a local function shadows an argument (600067, r=jorendorff).
This commit is contained in:
Родитель
367ff5c266
Коммит
114b2420e1
|
@ -169,6 +169,12 @@ PropertyTable::init(JSContext *cx, Shape *lastProp)
|
||||||
METER(searches);
|
METER(searches);
|
||||||
METER(initSearches);
|
METER(initSearches);
|
||||||
Shape **spp = search(shape.id, true);
|
Shape **spp = search(shape.id, true);
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Beware duplicate args and arg vs. var conflicts: the youngest shape
|
||||||
|
* (nearest to lastProp) must win. See bug 600067.
|
||||||
|
*/
|
||||||
|
if (!SHAPE_FETCH(spp))
|
||||||
SHAPE_STORE_PRESERVING_COLLISION(spp, &shape);
|
SHAPE_STORE_PRESERVING_COLLISION(spp, &shape);
|
||||||
}
|
}
|
||||||
return true;
|
return true;
|
||||||
|
|
|
@ -45,3 +45,4 @@ script regress-597870.js
|
||||||
fails-if(!xulRuntime.shell) script regress-597945-1.js
|
fails-if(!xulRuntime.shell) script regress-597945-1.js
|
||||||
script regress-597945-2.js
|
script regress-597945-2.js
|
||||||
script regress-598176.js
|
script regress-598176.js
|
||||||
|
script regress-600067.js
|
||||||
|
|
|
@ -0,0 +1,16 @@
|
||||||
|
/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
|
||||||
|
/*
|
||||||
|
* Any copyright is dedicated to the Public Domain.
|
||||||
|
* http://creativecommons.org/licenses/publicdomain/
|
||||||
|
*/
|
||||||
|
|
||||||
|
/*
|
||||||
|
* NB: this test hardcodes for the value of PropertyTable::HASH_THRESHOLD (6).
|
||||||
|
*/
|
||||||
|
|
||||||
|
function s(e) {
|
||||||
|
var a, b, c, d;
|
||||||
|
function e() { }
|
||||||
|
}
|
||||||
|
|
||||||
|
reportCompare(0, 0, "don't crash");
|
Загрузка…
Ссылка в новой задаче