Backed out changeset 822901f56c1f (bug 1170216)
authorCarsten "Tomcat" Book <cbook@mozilla.com>
Wed, 17 Jun 2015 11:02:52 +0200
changeset 249320 ed587a5aaecf2afd6313a1c6aa230210811e7603
parent 249319 a74edde76e5dd559568b045fed1348c5748b4384
child 249321 0c43e4255e88976832574b1695ab3d9c19e77a94
push id28923
push userryanvm@gmail.com
push dateWed, 17 Jun 2015 18:57:11 +0000
treeherdermozilla-central@099d6cd6725e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1170216
milestone41.0a1
backs out822901f56c1fe2ed23d638cc90759ffe08a0e93c
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Backed out changeset 822901f56c1f (bug 1170216)
js/src/jsobj.cpp
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -543,29 +543,16 @@ js::SetIntegrityLevel(JSContext* cx, Han
 
             last = cx->compartment()->propertyTree.getChild(cx, last, *child);
             if (!last)
                 return false;
         }
 
         MOZ_ASSERT(nobj->lastProperty()->slotSpan() == last->slotSpan());
         JS_ALWAYS_TRUE(nobj->setLastProperty(cx, last));
-
-        // Ordinarily ArraySetLength handles this, but we're going behind its back
-        // right now, so we must do this manually.
-        //
-        // ArraySetLength also implements the capacity <= length invariant for
-        // arrays with non-writable length.  We don't need to do anything special
-        // for that, because capacity was zeroed out by preventExtensions.  (See
-        // the assertion about getDenseCapacity above.)
-        if (level == IntegrityLevel::Frozen && obj->is<ArrayObject>()) {
-            if (!obj->as<ArrayObject>().maybeCopyElementsForWrite(cx))
-                return false;
-            obj->as<ArrayObject>().getElementsHeader()->setNonwritableArrayLength();
-        }
     } else {
         RootedId id(cx);
         Rooted<PropertyDescriptor> desc(cx);
 
         const unsigned AllowConfigure = JSPROP_IGNORE_ENUMERATE | JSPROP_IGNORE_READONLY |
                                         JSPROP_IGNORE_VALUE;
         const unsigned AllowConfigureAndWritable = AllowConfigure & ~JSPROP_IGNORE_READONLY;
 
@@ -594,16 +581,31 @@ js::SetIntegrityLevel(JSContext* cx, Han
             }
 
             // 8.a.i-ii. / 9.a.iii.3-4
             if (!DefineProperty(cx, obj, id, desc))
                 return false;
         }
     }
 
+    // Ordinarily ArraySetLength handles this, but we're going behind its back
+    // right now, so we must do this manually.  Neither the custom property
+    // tree mutations nor the DefineProperty call in the above code will do
+    // this for us.
+    //
+    // ArraySetLength also implements the capacity <= length invariant for
+    // arrays with non-writable length.  We don't need to do anything special
+    // for that, because capacity was zeroed out by preventExtensions.  (See
+    // the assertion before the if-else above.)
+    if (level == IntegrityLevel::Frozen && obj->is<ArrayObject>()) {
+        if (!obj->as<ArrayObject>().maybeCopyElementsForWrite(cx))
+            return false;
+        obj->as<ArrayObject>().getElementsHeader()->setNonwritableArrayLength();
+    }
+
     return true;
 }
 
 // ES6 draft rev33 (12 Feb 2015) 7.3.15
 bool
 js::TestIntegrityLevel(JSContext* cx, HandleObject obj, IntegrityLevel level, bool* result)
 {
     // Steps 3-6. (Steps 1-2 are redundant assertions.)