[INFER] Handle DEFAULT_NAMESPACE_ID in MakeTypeId, bug 640079.
authorBrian Hackett <bhackett1024@gmail.com>
Tue, 08 Mar 2011 23:00:28 -0800
changeset 74741 60670ecd2133e283987e4c96212df8a8ab509924
parent 74740 e39b459497a98d378187a177a1a6938561c5307a
child 74742 acd2e423b6e1e83b19d5af1d37a321a13aed515a
push id2
push userbsmedberg@mozilla.com
push dateFri, 19 Aug 2011 14:38:13 +0000
bugs640079
milestone2.0b12pre
[INFER] Handle DEFAULT_NAMESPACE_ID in MakeTypeId, bug 640079.
js/src/jit-test/tests/basic/bug640079.js
js/src/jsinfer.cpp
js/src/jsinferinlines.h
js/src/jsxml.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug640079.js
@@ -0,0 +1,4 @@
+eval("\
+  x = evalcx('split');\
+  evalcx(\"for(e in <x/>){}\" ,x)\
+")
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -249,18 +249,17 @@ bool
 TypeHasProperty(JSContext *cx, TypeObject *obj, jsid id, const Value &value)
 {
     /*
      * Check the correctness of the type information in the object's property
      * against an actual value. Note that we are only checking the .types set,
      * not the .ownTypes set, and could miss cases where a type set is missing
      * entries from its ownTypes set when they are shadowed by a prototype property.
      */
-    if (cx->typeInferenceEnabled() && !obj->unknownProperties && !value.isUndefined() &&
-        !JSID_IS_DEFAULT_XML_NAMESPACE(id)) {
+    if (cx->typeInferenceEnabled() && !obj->unknownProperties && !value.isUndefined()) {
         id = MakeTypeId(cx, id);
 
         /* Watch for properties which inference does not monitor. */
         if (id == id___proto__(cx) || id == id_constructor(cx) || id == id_caller(cx))
             return true;
 
         /*
          * If we called in here while resolving a type constraint, we may be in the
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -85,30 +85,23 @@ GetValueType(JSContext *cx, const Value 
 /*
  * Get the canonical representation of an id to use when doing inference.  This
  * maintains the constraint that if two different jsids map to the same property
  * in JS (e.g. 3 and "3"), they have the same type representation.
  */
 inline jsid
 MakeTypeId(JSContext *cx, jsid id)
 {
-    if (JSID_IS_VOID(id))
-        return JSID_VOID;
-
     /*
      * All integers must map to the aggregate property for index types, including
      * negative integers.
      */
     if (JSID_IS_INT(id))
         return JSID_VOID;
 
-    /* :FIXME: What are object jsids for? Only XML seems to do this. */
-    if (JSID_IS_OBJECT(id))
-        return JSID_VOID;
-
     /*
      * Check for numeric strings, as in js_StringIsIndex, but allow negative
      * and overflowing integers.
      */
     if (JSID_IS_STRING(id)) {
         JSFlatString *str = JSID_TO_FLAT_STRING(id);
         const jschar *cp = str->getCharsZ(cx);
         if (JS7_ISDEC(*cp) || *cp == '-') {
@@ -116,17 +109,16 @@ MakeTypeId(JSContext *cx, jsid id)
             while (JS7_ISDEC(*cp))
                 cp++;
             if (unsigned(cp - str->chars()) == str->length())
                 return JSID_VOID;
         }
         return id;
     }
 
-    JS_NOT_REACHED("Unknown id");
     return JSID_VOID;
 }
 
 const char * TypeIdStringImpl(jsid id);
 
 /* Convert an id for printing during debug. */
 static inline const char *
 TypeIdString(jsid id)
--- a/js/src/jsxml.cpp
+++ b/js/src/jsxml.cpp
@@ -7273,16 +7273,19 @@ js_GetDefaultXMLNamespace(JSContext *cx,
             return JS_FALSE;
         if (!JSVAL_IS_PRIMITIVE(v)) {
             *vp = v;
             return JS_TRUE;
         }
         obj = tmp;
     }
 
+    if (!cx->addTypePropertyId(obj->getType(), JS_DEFAULT_XML_NAMESPACE_ID, types::TYPE_UNKNOWN))
+        return JS_FALSE;
+
     ns = js_ConstructObject(cx, &js_NamespaceClass, NULL, obj, 0, NULL);
     if (!ns)
         return JS_FALSE;
     v = OBJECT_TO_JSVAL(ns);
     if (!obj->defineProperty(cx, JS_DEFAULT_XML_NAMESPACE_ID, Valueify(v),
                              PropertyStub, StrictPropertyStub, JSPROP_PERMANENT)) {
         return JS_FALSE;
     }