[INFER] Use type barrier for values produced by class getProperty hooks, bug 655938.
authorBrian Hackett <bhackett1024@gmail.com>
Tue, 10 May 2011 06:17:32 -0700
changeset 75019 2b272d7fb2e5eacb99e1752ed84743fc6d4c439d
parent 75018 d1724a9944bd0454772837e72ed938fab739195e
child 75020 d6a536a03af1ffe10a418fb6d4ebabd74d1ec27f
push id2
push userbsmedberg@mozilla.com
push dateFri, 19 Aug 2011 14:38:13 +0000
bugs655938
milestone6.0a1
[INFER] Use type barrier for values produced by class getProperty hooks, bug 655938.
js/src/jsobj.cpp
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -5694,16 +5694,20 @@ js_GetPropertyHelperWithShapeInline(JSCo
     if (!prop) {
         vp->setUndefined();
 
         if (!CallJSPropertyOp(cx, obj->getClass()->getProperty, obj, id, vp))
             return JS_FALSE;
 
         PCMETER(getHow & JSGET_CACHE_RESULT && JS_PROPERTY_CACHE(cx).nofills++);
 
+        /* Record non-undefined values produced by the class getter hook. */
+        if (!vp->isUndefined())
+            cx->addTypePropertyId(obj->getType(), id, *vp);
+
         /*
          * Give a strict warning if foo.bar is evaluated by a script for an
          * object foo with no property named 'bar'.
          */
         jsbytecode *pc;
         if (vp->isUndefined() && ((pc = js_GetCurrentBytecodePC(cx)) != NULL)) {
             JSOp op;
             uintN flags;