Bug 643222: Don't assert that we never cached adds to call objects. r=jorendorff
authorJim Blandy <jimb@mozilla.com>
Wed, 30 Mar 2011 12:48:24 -0700
changeset 64552 1e5ded29dd9f2c15c9fa2453e844832217417b28
parent 64551 d10c089a6888f29f4e097990b49afb1a5c16396b
child 64553 b55ca8a7c0ade1a42e8460f3156062e542daf5f1
push id19362
push usercleary@mozilla.com
push dateThu, 31 Mar 2011 22:50:13 +0000
treeherdermozilla-central@6da508f70672 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjorendorff
bugs643222, 554955
milestone2.2a1pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 643222: Don't assert that we never cached adds to call objects. r=jorendorff This assertion should not have been added. Although most adds to call objects are done by DEFVAR operations, which don't create property cache entries, the test case shows a situation in which a SETNAME, which is cached, does the add. Since the object whose property should receive the value of an assignment's RHS is chosen before the RHS is evaluated, it is correct to put the value of the 'delete' expression on the call. It would be nice to ensure that this call object, which we know we are adding bindings to, had been recognized as extensible at compile time by the analysis added in bug 554955. However, we only set "extensible parents" flag on the bindings of calls whose *parents* are extensible, not the extensible calls themselves. So there isn't anything convenient to check here.
js/src/jspropertycache.cpp
js/src/tests/js1_8_5/regress/jstests.list
js/src/tests/js1_8_5/regress/regress-643222.js
--- a/js/src/jspropertycache.cpp
+++ b/js/src/jspropertycache.cpp
@@ -56,17 +56,16 @@ PropertyCache::fill(JSContext *cx, JSObj
     jsuword kshape, vshape;
     JSOp op;
     const JSCodeSpec *cs;
     PCVal vword;
     PropertyCacheEntry *entry;
 
     JS_ASSERT(this == &JS_PROPERTY_CACHE(cx));
     JS_ASSERT(!cx->runtime->gcRunning);
-    JS_ASSERT_IF(adding, !obj->isCall());
 
     if (js_IsPropertyCacheDisabled(cx)) {
         PCMETER(disfills++);
         return JS_NO_PROP_CACHE_FILL;
     }
 
     /*
      * Check for fill from js_SetPropertyHelper where the setter removed shape
--- a/js/src/tests/js1_8_5/regress/jstests.list
+++ b/js/src/tests/js1_8_5/regress/jstests.list
@@ -94,8 +94,9 @@ fails-if(xulRuntime.shell) script regres
 script regress-634210-1.js
 script regress-634210-2.js
 script regress-634210-3.js
 script regress-634210-4.js
 script regress-635195.js
 script regress-636394.js
 script regress-636364.js
 script regress-640075.js
+script regress-643222.js
new file mode 100644
--- /dev/null
+++ b/js/src/tests/js1_8_5/regress/regress-643222.js
@@ -0,0 +1,12 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+/* This shouldn't trigger an assertion. */
+(function () {
+    eval("var x=delete(x)")
+})();
+
+reportCompare(0, 0, "ok");