Bug 1333796 - Set descriptor value as undefined in XrayResolveAttribute. r=evilpie
authorYury Delendik <ydelendik@mozilla.com>
Wed, 25 Jan 2017 16:15:09 -0600
changeset 377912 1903f5700583ead18fc648a9992490fde308331c
parent 377911 ab540f0d551bb0187e891607ea79c473fd8a0276
child 377913 da16b343188e2dabc68efb4f51cffdca00f12444
push id7198
push userjlorenzo@mozilla.com
push dateTue, 18 Apr 2017 12:07:49 +0000
treeherdermozilla-beta@d57aa49c3948 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersevilpie
bugs1333796
milestone54.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1333796 - Set descriptor value as undefined in XrayResolveAttribute. r=evilpie When property getter is specified the desc's value must the set to undefined -- the desc can be re-used by a caller, so it must be done to preserve this PropertyDescriptor invariant. We also do this in NativeGetOwnPropertyDescriptor. MozReview-Commit-ID: 39MCwplbzL3
dom/bindings/BindingUtils.cpp
--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -1333,16 +1333,17 @@ XrayResolveAttribute(JSContext* cx, JS::
             if (!funobj)
               return false;
             desc.setSetterObject(funobj);
             desc.attributesRef() |= JSPROP_SETTER;
           } else {
             desc.setSetter(nullptr);
           }
           desc.object().set(wrapper);
+          desc.value().setUndefined();
           return true;
         }
       }
     }
   }
   return true;
 }