Don't allow sets to readonly properties (bug 810925, r=kannan).
authorDavid Anderson <danderson@mozilla.com>
Thu, 15 Nov 2012 18:32:57 -0800
changeset 113465 ef467dfbbc0d4d7dc738179c83c35dba2a6648ba
parent 113464 c2e247f9d207ea850dba5cc7e15ca1b9956e2119
child 113466 6d4a9a61a335b928eec0cc38a0591a2e8c9e0808
push id23872
push useremorley@mozilla.com
push dateFri, 16 Nov 2012 17:06:27 +0000
treeherdermozilla-central@a7ed19f7d21a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerskannan
bugs810925
milestone19.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Don't allow sets to readonly properties (bug 810925, r=kannan).
js/src/ion/IonCaches.cpp
--- a/js/src/ion/IonCaches.cpp
+++ b/js/src/ion/IonCaches.cpp
@@ -1297,17 +1297,17 @@ IsPropertyAddInlineable(JSContext *cx, H
     Shape *shape = obj->nativeLookup(cx, id);
     if (!shape || shape->inDictionary() || !shape->hasSlot() || !shape->hasDefaultSetter())
         return false;
 
     // If object has a non-default resolve hook, don't inline
     if (obj->getClass()->resolve != JS_ResolveStub)
         return false;
 
-    if (!obj->isExtensible())
+    if (!obj->isExtensible() || !shape->writable())
         return false;
 
     // walk up the object prototype chain and ensure that all prototypes
     // are native, and that all prototypes have no getter or setter
     // defined on the property
     for (JSObject *proto = obj->getProto(); proto; proto = proto->getProto()) {
         // if prototype is non-native, don't optimize
         if (!proto->isNative())