Bug 1125389 - Fix NewReshapedObject to use the old shape's data. r=jandem
☠☠ backed out by e79c310fc659 ☠ ☠
authorBrian Hackett <bhackett1024@gmail.com>
Tue, 27 Jan 2015 14:29:05 -0500
changeset 239478 8361462f2a02c9535b315a7b6e55df9513f5540b
parent 239477 35f422e0053ccd5bb3d6096675222f0a97985be8
child 239479 605f1d807083df8efdbe2966d356cb1eb6c82021
push id500
push userjoshua.m.grant@gmail.com
push dateThu, 29 Jan 2015 01:48:36 +0000
reviewersjandem
bugs1125389
milestone38.0a1
Bug 1125389 - Fix NewReshapedObject to use the old shape's data. r=jandem
js/src/vm/Shape.cpp
--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -635,17 +635,22 @@ js::NewReshapedObject(JSContext *cx, Han
         while (!nshape->isEmptyShape()) {
             ids[nshape->slot()].set(nshape->propid());
             nshape = nshape->previous();
         }
     }
 
     /* Construct the new shape, without updating type information. */
     RootedId id(cx);
-    RootedShape newShape(cx, res->lastProperty());
+    RootedShape newShape(cx, EmptyShape::getInitialShape(cx, res->getClass(),
+                                                         res->getTaggedProto(),
+                                                         res->getMetadata(),
+                                                         res->getParent(),
+                                                         res->numFixedSlots(),
+                                                         shape->getObjectFlags()));
     for (unsigned i = 0; i < ids.length(); i++) {
         id = ids[i];
         MOZ_ASSERT(!res->contains(cx, id));
 
         uint32_t index;
         bool indexed = js_IdIsIndex(id, &index);
 
         Rooted<UnownedBaseShape*> nbase(cx, newShape->base()->unowned());