Bug 533876 - In JSScope::{add,put}Property, disregard the SPROP_IN_DICTIONARY bit of the flags. r=brendan.
authorJason Orendorff <jorendorff@mozilla.com>
Thu, 14 Jan 2010 17:20:27 -0600
changeset 37690 3036013432ce47875bce99e7c1ab54cdc1532ce4
parent 37689 ca960fb05abd249278043809a2278e0d979e024d
child 37691 aba69ed5c41d80d5344475dd3a42eb92a3d16efe
push idunknown
push userunknown
push dateunknown
reviewersbrendan
bugs533876
milestone1.9.3a1pre
Bug 533876 - In JSScope::{add,put}Property, disregard the SPROP_IN_DICTIONARY bit of the flags. r=brendan.
js/src/jsscope.cpp
js/src/tests/js1_8_5/regress/browser.js
js/src/tests/js1_8_5/regress/jstests.list
js/src/tests/js1_8_5/regress/regress-533876.js
js/src/tests/js1_8_5/regress/shell.js
--- a/js/src/jsscope.cpp
+++ b/js/src/jsscope.cpp
@@ -1011,17 +1011,18 @@ JSScope::getChildProperty(JSContext *cx,
     if (inDictionaryMode()) {
         JS_ASSERT(parent == lastProp);
         if (newDictionaryProperty(cx, child, &lastProp)) {
             updateShape(cx);
             return lastProp;
         }
         return NULL;
     }
-    
+
+    child.flags &= ~SPROP_IN_DICTIONARY;
     JSScopeProperty *sprop = GetPropertyTreeChild(cx, parent, child);
     if (sprop) {
         JS_ASSERT(sprop->parent == parent);
         if (parent == lastProp) {
             extend(cx, sprop);
         } else {
             JS_ASSERT(parent == lastProp->parent);
             setLastProperty(sprop);
copy from js/src/tests/js1_8_1/regress/browser.js
copy to js/src/tests/js1_8_5/regress/browser.js
new file mode 100644
--- /dev/null
+++ b/js/src/tests/js1_8_5/regress/jstests.list
@@ -0,0 +1,2 @@
+url-prefix ../../jsreftest.html?test=js1_8_5/regress/
+script regress-533876.js
new file mode 100644
--- /dev/null
+++ b/js/src/tests/js1_8_5/regress/regress-533876.js
@@ -0,0 +1,20 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributors: Gary Kwong and Jason Orendorff
+ */
+gTestfile = 'regress-533876';
+
+var x = [0];
+eval();
+
+x.__proto__ = this;  // x has non-dictionary scope
+try {
+    DIE;
+} catch(e) {
+}
+
+delete eval;  // force dictionary scope for global
+gc();
+var f = eval("function () { return /x/; }");
+x.watch('x', f);  // clone property from global to x, including SPROP_IN_DICTIONARY flag
copy from js/src/tests/js1_8_1/regress/shell.js
copy to js/src/tests/js1_8_5/regress/shell.js