Commit 943d9959 authored by Brian Hackett's avatar Brian Hackett
Browse files

Properly watch for indexed prototypes and configured properties in array...

Properly watch for indexed prototypes and configured properties in array prototype, bug 709067. r=luke
parent 1c679d8e
Loading
Loading
Loading
Loading
+11 −0
Original line number Diff line number Diff line
called = 0;
Object.defineProperty(Object.prototype, 0, {set: function() { called++; }});
function testInit()
{
  var a = [];
  for (var i = 0; i < 5; i++)
    a[i] = 0;
}
for (var i = 0; i < 100; i++)
  testInit();
assertEq(called, 100);
+12 −10
Original line number Diff line number Diff line
@@ -7702,17 +7702,19 @@ mjit::Compiler::arrayPrototypeHasIndexedProperty()

    JSObject *proto;
    if (!js_GetClassPrototype(cx, NULL, JSProto_Array, &proto, NULL))
        return false;
        return true;

    /*
     * It is sufficient to check just Array.prototype; if Object.prototype is
     * unknown or has an indexed property, those will be reflected in
     * Array.prototype.
     */
    if (proto->getType(cx)->unknownProperties())
    while (proto) {
        types::TypeObject *type = proto->getType(cx);
        if (type->unknownProperties())
            return true;
    types::TypeSet *arrayTypes = proto->getType(cx)->getProperty(cx, JSID_VOID, false);
    return !arrayTypes || arrayTypes->knownNonEmpty(cx);
        types::TypeSet *indexTypes = type->getProperty(cx, JSID_VOID, false);
        if (!indexTypes || indexTypes->isOwnProperty(cx, type, true) || indexTypes->knownNonEmpty(cx))
            return true;
        proto = proto->getProto();
    }

    return false;
}

/*