Bug 613452 - "Assertion failure: obj->isExtensible()" with Object.seal, sharps. r=Waldo.
authorJason Orendorff <jorendorff@mozilla.com>
Thu, 11 Aug 2011 13:24:56 -0500
changeset 74266 0f6ccf479e1016c81ab6b35593db7d6e864dfaf2
parent 74265 223d4f4bd252fac3ed3591692b84d06f27f010e8
child 74267 0324f71c6757d02ca6b7801b4689bebbed553d81
push id2
push userbsmedberg@mozilla.com
push dateFri, 19 Aug 2011 14:38:13 +0000
reviewersWaldo
bugs613452
milestone8.0a1
Bug 613452 - "Assertion failure: obj->isExtensible()" with Object.seal, sharps. r=Waldo.
js/src/jspropertycacheinlines.h
js/src/tests/js1_8_5/extensions/jstests.list
js/src/tests/js1_8_5/extensions/regress-613452.js
--- a/js/src/jspropertycacheinlines.h
+++ b/js/src/jspropertycacheinlines.h
@@ -125,28 +125,31 @@ PropertyCache::testForSet(JSContext *cx,
     return false;
 }
 
 JS_ALWAYS_INLINE bool
 PropertyCache::testForInit(JSRuntime *rt, jsbytecode *pc, JSObject *obj,
                            const js::Shape **shapep, PropertyCacheEntry **entryp)
 {
     JS_ASSERT(obj->slotSpan() >= JSSLOT_FREE(obj->getClass()));
-    JS_ASSERT(obj->isExtensible());
     uint32 kshape = obj->shape();
     PropertyCacheEntry *entry = &table[hash(pc, kshape)];
     *entryp = entry;
     PCMETER(pctestentry = entry);
     PCMETER(tests++);
     PCMETER(initests++);
     JS_ASSERT(entry->kshape < SHAPE_OVERFLOW_BIT);
 
     if (entry->kpc == pc &&
         entry->kshape == kshape &&
         entry->vshape() == rt->protoHazardShape) {
+        // If obj is not extensible, we cannot have a cache hit. This happens
+        // for sharp-variable expressions like (#1={x: Object.seal(#1#)}).
+        JS_ASSERT(obj->isExtensible());
+
         PCMETER(pchits++);
         PCMETER(inipchits++);
         JS_ASSERT(entry->vcapTag() == 0);
         *shapep = entry->vword.toShape();
         JS_ASSERT((*shapep)->writable());
         return true;
     }
     return false;
--- a/js/src/tests/js1_8_5/extensions/jstests.list
+++ b/js/src/tests/js1_8_5/extensions/jstests.list
@@ -29,16 +29,17 @@ skip-if(!xulRuntime.shell) script clone-
 skip-if(!xulRuntime.shell) script clone-forge.js
 skip-if(!xulRuntime.shell) script clone-complex-object.js
 script set-property-non-extensible.js
 script recursion.js
 script findReferences-01.js
 script findReferences-02.js
 script findReferences-03.js
 script findReferences-04.js
+script regress-613452.js
 script regress-627859.js
 script regress-627984-1.js
 script regress-627984-2.js
 script regress-627984-3.js
 script regress-627984-4.js
 script regress-627984-5.js
 script regress-627984-6.js
 script regress-627984-7.js
new file mode 100644
--- /dev/null
+++ b/js/src/tests/js1_8_5/extensions/regress-613452.js
@@ -0,0 +1,13 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+
+for (var i = 0; i < 2; i++) {
+    try {
+        (#1={x: Object.seal(#1#)});  // do not assert
+    } catch (exc) {}
+}
+
+for (var i = 0; i < 2; i++)
+    (#1={x: (#1#.x = 1, Object.seal(#1#))});  // do not assert
+
+reportCompare(0, 0, 'ok');