Loading js/src/jit-test/tests/jaeger/bug709067.js 0 → 100644 +11 −0 Original line number Diff line number Diff line called = 0; Object.defineProperty(Object.prototype, 0, {set: function() { called++; }}); function testInit() { var a = []; for (var i = 0; i < 5; i++) a[i] = 0; } for (var i = 0; i < 100; i++) testInit(); assertEq(called, 100); js/src/methodjit/Compiler.cpp +12 −10 Original line number Diff line number Diff line Loading @@ -7702,17 +7702,19 @@ mjit::Compiler::arrayPrototypeHasIndexedProperty() JSObject *proto; if (!js_GetClassPrototype(cx, NULL, JSProto_Array, &proto, NULL)) return false; return true; /* * It is sufficient to check just Array.prototype; if Object.prototype is * unknown or has an indexed property, those will be reflected in * Array.prototype. */ if (proto->getType(cx)->unknownProperties()) while (proto) { types::TypeObject *type = proto->getType(cx); if (type->unknownProperties()) return true; types::TypeSet *arrayTypes = proto->getType(cx)->getProperty(cx, JSID_VOID, false); return !arrayTypes || arrayTypes->knownNonEmpty(cx); types::TypeSet *indexTypes = type->getProperty(cx, JSID_VOID, false); if (!indexTypes || indexTypes->isOwnProperty(cx, type, true) || indexTypes->knownNonEmpty(cx)) return true; proto = proto->getProto(); } return false; } /* Loading Loading
js/src/jit-test/tests/jaeger/bug709067.js 0 → 100644 +11 −0 Original line number Diff line number Diff line called = 0; Object.defineProperty(Object.prototype, 0, {set: function() { called++; }}); function testInit() { var a = []; for (var i = 0; i < 5; i++) a[i] = 0; } for (var i = 0; i < 100; i++) testInit(); assertEq(called, 100);
js/src/methodjit/Compiler.cpp +12 −10 Original line number Diff line number Diff line Loading @@ -7702,17 +7702,19 @@ mjit::Compiler::arrayPrototypeHasIndexedProperty() JSObject *proto; if (!js_GetClassPrototype(cx, NULL, JSProto_Array, &proto, NULL)) return false; return true; /* * It is sufficient to check just Array.prototype; if Object.prototype is * unknown or has an indexed property, those will be reflected in * Array.prototype. */ if (proto->getType(cx)->unknownProperties()) while (proto) { types::TypeObject *type = proto->getType(cx); if (type->unknownProperties()) return true; types::TypeSet *arrayTypes = proto->getType(cx)->getProperty(cx, JSID_VOID, false); return !arrayTypes || arrayTypes->knownNonEmpty(cx); types::TypeSet *indexTypes = type->getProperty(cx, JSID_VOID, false); if (!indexTypes || indexTypes->isOwnProperty(cx, type, true) || indexTypes->knownNonEmpty(cx)) return true; proto = proto->getProto(); } return false; } /* Loading