зеркало из https://github.com/mozilla/gecko-dev.git
Guard that object is a dense array when skipping to its prototype during property lookup (485790, r=brendan).
This commit is contained in:
Родитель
f156a254b7
Коммит
5af1f75903
|
@ -5711,6 +5711,7 @@ TraceRecorder::test_property_cache(JSObject* obj, LIns* obj_ins, JSObject*& obj2
|
|||
// typically to find Array.prototype methods.
|
||||
JSObject* aobj = obj;
|
||||
if (OBJ_IS_DENSE_ARRAY(cx, obj)) {
|
||||
guardDenseArray(obj, obj_ins, BRANCH_EXIT);
|
||||
aobj = OBJ_GET_PROTO(cx, obj);
|
||||
obj_ins = stobj_get_fslot(obj_ins, JSSLOT_PROTO);
|
||||
}
|
||||
|
|
|
@ -4760,6 +4760,19 @@ function testWhileObjectOrNull()
|
|||
testWhileObjectOrNull.expected = "pass";
|
||||
test(testWhileObjectOrNull);
|
||||
|
||||
function testDenseArrayProp()
|
||||
{
|
||||
[].__proto__.x = 1;
|
||||
({}).__proto__.x = 2;
|
||||
var a = [[],[],[],({}).__proto__];
|
||||
for (var i = 0; i < a.length; ++i)
|
||||
uneval(a[i].x);
|
||||
delete [].__proto__.x;
|
||||
delete ({}).__proto__.x;
|
||||
return "ok";
|
||||
}
|
||||
testDenseArrayProp.expected = "ok";
|
||||
test(testDenseArrayProp);
|
||||
|
||||
/*****************************************************************************
|
||||
* *
|
||||
|
@ -5073,4 +5086,4 @@ test(testGlobalProtoAccess);
|
|||
if (gReportSummary) {
|
||||
print("\npassed:", passes.length && passes.join(","));
|
||||
print("\nFAILED:", fails.length && fails.join(","));
|
||||
}
|
||||
}
|
||||
|
|
Загрузка…
Ссылка в новой задаче