From 177c02d30f86cc8a0defc94df0af636ca637a9ee Mon Sep 17 00:00:00 2001
From: "brendan%mozilla.org" <brendan%mozilla.org>
Date: Fri, 8 Sep 2006 06:53:40 +0000
Subject: [PATCH] Fix js_CheckRedeclaration to drop a found property if the
 caller doesn't want it but there's no redeclaration error (351717, r=mrbkap).

---
 js/src/jsinterp.c | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/js/src/jsinterp.c b/js/src/jsinterp.c
index f4cad0127c8b..2b17711ce615 100644
--- a/js/src/jsinterp.c
+++ b/js/src/jsinterp.c
@@ -1769,9 +1769,26 @@ js_CheckRedeclaration(JSContext *cx, JSObject *obj, jsid id, uintN attrs,
     if (!prop)
         return JS_TRUE;
 
-    /* From here, return true, or goto bad on failure to drop prop. */
-    if (!OBJ_GET_ATTRIBUTES(cx, obj2, id, prop, &oldAttrs))
+    /*
+     * Use prop as a speedup hint to OBJ_GET_ATTRIBUTES, but drop it on error.
+     * An assertion at label bad: will insist that it is null.
+     */
+    if (!OBJ_GET_ATTRIBUTES(cx, obj2, id, prop, &oldAttrs)) {
+        OBJ_DROP_PROPERTY(cx, obj2, prop);
+#ifdef DEBUG
+        prop = NULL;
+#endif
         goto bad;
+    }
+
+    /*
+     * From here, return true, or else goto bad on failure to null out params.
+     * If our caller doesn't want prop, drop it (we don't need it any longer).
+     */
+    if (!propp) {
+        OBJ_DROP_PROPERTY(cx, obj2, prop);
+        prop = NULL;
+    }
 
     /* If either property is readonly, we have an error. */
     report = ((oldAttrs | attrs) & JSPROP_READONLY)
@@ -1822,7 +1839,7 @@ bad:
         *objp = NULL;
         *propp = NULL;
     }
-    OBJ_DROP_PROPERTY(cx, obj2, prop);
+    JS_ASSERT(!prop);
     return JS_FALSE;
 }