Avoid assert botch when adding properties to objects, bug 684505.
authorBrian Hackett <bhackett1024@gmail.com>
Thu, 29 Sep 2011 20:46:33 -0700
changeset 81237 174db15b3f05259acea6e01d83cdec5a8d4a0473
parent 81236 c9be55115ad8d40540394421223b94142a7dd51b
child 81238 8ca7929765ac22e8e2f2bb4c2aa969807fd5c63d
push id21565
push userbhackett@mozilla.com
push dateSat, 03 Dec 2011 20:25:52 +0000
treeherdermozilla-central@13afcd4c097c [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs684505
milestone9.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Avoid assert botch when adding properties to objects, bug 684505.
js/src/jsscope.cpp
--- a/js/src/jsscope.cpp
+++ b/js/src/jsscope.cpp
@@ -637,17 +637,17 @@ JSObject::addPropertyInternal(JSContext 
 {
     JS_ASSERT_IF(!allowDictionary, !inDictionaryMode());
 
     PropertyTable *table = NULL;
     if (!inDictionaryMode()) {
         bool stableSlot =
             (slot == SHAPE_INVALID_SLOT) ||
             lastProp->hasMissingSlot() ||
-            (slot == lastProp->slot() + 1);
+            (slot == lastProp->maybeSlot() + 1);
         JS_ASSERT_IF(!allowDictionary, stableSlot);
         if (allowDictionary &&
             (!stableSlot || lastProp->entryCount() >= PropertyTree::MAX_HEIGHT)) {
             if (!toDictionaryMode(cx))
                 return NULL;
             spp = nativeSearch(cx, id, true);
             table = lastProp->getTable();
         }