Bug 1407058 - Fix isDataProperty to return false for accessors with nullptr getter/setter. r=evilpie

js/src/jit-test/tests/basic/bug1407058.js

@@ -0,0 +1,16 @@
+"use strict";
+function f() {
+    var o = {};
+    Object.defineProperty(o, "x", {get: undefined, set: undefined});
+    for (var i = 0; i < 20; i++) {
+        var ex = null;
+        try {
+            o.x = 9;
+        } catch (e) {
+            ex = e;
+        }
+        assertEq(ex instanceof TypeError, true);
+        assertEq(o.x, undefined);
+    }
+}
+f();

js/src/vm/Shape.cpp

@@ -746,7 +746,7 @@ NativeObject::putProperty(JSContext* cx, HandleNativeObject obj, HandleId id,
      */
     bool hadSlot = shape->isDataProperty();
     uint32_t oldSlot = shape->maybeSlot();
-    bool needSlot = !getter && !setter;
+    bool needSlot = Shape::isDataProperty(attrs, getter, setter);
     if (needSlot && slot == SHAPE_INVALID_SLOT && hadSlot)
         slot = oldSlot;
 
@@ -789,7 +789,7 @@ NativeObject::putProperty(JSContext* cx, HandleNativeObject obj, HandleId id,
          * is also the last property).
          */
         bool updateLast = (shape == obj->lastProperty());
-        bool accessorShape = getter || setter || (attrs & (JSPROP_GETTER | JSPROP_SETTER));
+        bool accessorShape = !Shape::isDataProperty(attrs, getter, setter);
         shape = NativeObject::replaceWithNewEquivalentShape(cx, obj, shape, nullptr,
                                                             accessorShape);
         if (!shape)
@@ -872,7 +872,7 @@ NativeObject::changeProperty(JSContext* cx, HandleNativeObject obj, HandleShape
 
     /* Allow only shared (slotless) => unshared (slotful) transition. */
 #ifdef DEBUG
-    bool needSlot = !getter && !setter;
+    bool needSlot = Shape::isDataProperty(attrs, getter, setter);
     MOZ_ASSERT_IF(shape->isDataProperty() != needSlot, needSlot);
 #endif
 

js/src/vm/Shape.h

@@ -1013,9 +1013,13 @@ class Shape : public gc::TenuredCell
 
     BaseShape* base() const { return base_.get(); }
 
+    static bool isDataProperty(unsigned attrs, GetterOp getter, SetterOp setter) {
+        return !(attrs & (JSPROP_GETTER | JSPROP_SETTER)) && !getter && !setter;
+    }
+
     bool isDataProperty() const {
         MOZ_ASSERT(!isEmptyShape());
-        return !getter() && !setter();
+        return isDataProperty(attrs, getter(), setter());
     }
     uint32_t slot() const { MOZ_ASSERT(isDataProperty() && !hasMissingSlot()); return maybeSlot(); }
     uint32_t maybeSlot() const {
@@ -1476,7 +1480,7 @@ struct StackShape
 
     bool isDataProperty() const {
         MOZ_ASSERT(!JSID_IS_EMPTY(propid));
-        return !rawGetter && !rawSetter;
+        return Shape::isDataProperty(attrs, rawGetter, rawSetter);
     }
     bool hasMissingSlot() const { return maybeSlot() == SHAPE_INVALID_SLOT; }