зеркало из https://github.com/mozilla/gecko-dev.git
fun->u.i.names is incorrect when a local function shadows an argument (600067, r=jorendorff).
This commit is contained in:
Родитель
367ff5c266
Коммит
114b2420e1
|
@ -169,6 +169,12 @@ PropertyTable::init(JSContext *cx, Shape *lastProp)
|
|||
METER(searches);
|
||||
METER(initSearches);
|
||||
Shape **spp = search(shape.id, true);
|
||||
|
||||
/*
|
||||
* Beware duplicate args and arg vs. var conflicts: the youngest shape
|
||||
* (nearest to lastProp) must win. See bug 600067.
|
||||
*/
|
||||
if (!SHAPE_FETCH(spp))
|
||||
SHAPE_STORE_PRESERVING_COLLISION(spp, &shape);
|
||||
}
|
||||
return true;
|
||||
|
|
|
@ -45,3 +45,4 @@ script regress-597870.js
|
|||
fails-if(!xulRuntime.shell) script regress-597945-1.js
|
||||
script regress-597945-2.js
|
||||
script regress-598176.js
|
||||
script regress-600067.js
|
||||
|
|
|
@ -0,0 +1,16 @@
|
|||
/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
|
||||
/*
|
||||
* Any copyright is dedicated to the Public Domain.
|
||||
* http://creativecommons.org/licenses/publicdomain/
|
||||
*/
|
||||
|
||||
/*
|
||||
* NB: this test hardcodes for the value of PropertyTable::HASH_THRESHOLD (6).
|
||||
*/
|
||||
|
||||
function s(e) {
|
||||
var a, b, c, d;
|
||||
function e() { }
|
||||
}
|
||||
|
||||
reportCompare(0, 0, "don't crash");
|
Загрузка…
Ссылка в новой задаче