Bug 645184: normalize id in addprop IC handler, r=dvander
authorDavid Mandelin <dmandelin@mozilla.com>
Wed, 30 Mar 2011 16:57:44 -0700
changeset 64555 76d04b5e5e75345190149c1cfb015b668ccaae6f
parent 64554 aba14034d8197dbc28a106680c8cd3e88ba0d7f1
child 64556 ba8cc57e0848818df689149c4eed99c4c0d7b5e9
push idunknown
push userunknown
push dateunknown
reviewersdvander
bugs645184
milestone2.2a1pre
Bug 645184: normalize id in addprop IC handler, r=dvander
js/src/jit-test/tests/pic/bug645184.js
js/src/methodjit/PolyIC.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/pic/bug645184.js
@@ -0,0 +1,8 @@
+var obj = new Object();
+var passed = true;
+for (var i = 0; i < 100; i++) {
+if (obj['-1'] == null)
+    obj['-1'] = new Array();
+    assertEq(obj['-1'] == null, false);
+    obj = new Object();
+}
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -555,16 +555,17 @@ class SetPropCompiler : public PICStubCo
                 getter = CastAsPropertyOp(funobj);
             }
 
             /*
              * Define the property but do not set it yet. For setmethod,
              * populate the slot to satisfy the method invariant (in case we
              * hit an early return below).
              */
+            id = js_CheckForStringIndex(id);
             const Shape *shape =
                 obj->putProperty(cx, id, getter, clasp->setProperty,
                                  SHAPE_INVALID_SLOT, JSPROP_ENUMERATE, flags, 0);
             if (!shape)
                 return error();
             if (flags & Shape::METHOD)
                 obj->nativeSetSlot(shape->slot, f.regs.sp[-1]);