Bug 1538006 - Propagate unknownProperties when changing prototype. r=jandem, a=dveditz
authorTed Campbell <tcampbell@mozilla.com>
Thu, 21 Mar 2019 22:36:46 +0000
changeset 465461 6b61fd0bb5973b023524911dee3aeb4dc1346df7
parent 465460 229759a67f4f26ccde9f7bde5423cfd82b216fa2
child 465462 2c49e736571bdcf4d8897eab3c3ad6d4a079f664
push id35740
push userryanvm@gmail.com
push dateFri, 22 Mar 2019 01:23:00 +0000
treeherdermozilla-central@2c49e736571b [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem, dveditz
bugs1538006
milestone68.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1538006 - Propagate unknownProperties when changing prototype. r=jandem, a=dveditz Differential Revision: https://phabricator.services.mozilla.com/D24446
js/src/vm/NativeObject.cpp
--- a/js/src/vm/NativeObject.cpp
+++ b/js/src/vm/NativeObject.cpp
@@ -1263,22 +1263,25 @@ static MOZ_ALWAYS_INLINE void UpdateShap
 }
 
 void js::AddPropertyTypesAfterProtoChange(JSContext* cx, NativeObject* obj,
                                           ObjectGroup* oldGroup) {
   AutoSweepObjectGroup sweepObjGroup(obj->group());
   MOZ_ASSERT(obj->group() != oldGroup);
   MOZ_ASSERT(!obj->group()->unknownProperties(sweepObjGroup));
 
+  AutoSweepObjectGroup sweepOldGroup(oldGroup);
+  if (oldGroup->unknownProperties(sweepOldGroup)) {
+    MarkObjectGroupUnknownProperties(cx, obj->group());
+    return;
+  }
+
   // First copy the dynamic flags.
-  AutoSweepObjectGroup sweepOldGroup(oldGroup);
   MarkObjectGroupFlags(
-      cx, obj,
-      oldGroup->flags(sweepOldGroup) &
-          (OBJECT_FLAG_DYNAMIC_MASK & ~OBJECT_FLAG_UNKNOWN_PROPERTIES));
+      cx, obj, oldGroup->flags(sweepOldGroup) & OBJECT_FLAG_DYNAMIC_MASK);
 
   // Now update all property types. If the object has many properties, this
   // function may be slow so we mark all properties as unknown.
   static const size_t MaxPropertyCount = 40;
 
   size_t nprops = obj->getDenseInitializedLength();
   if (nprops > MaxPropertyCount) {
     MarkObjectGroupUnknownProperties(cx, obj->group());