Bug 1252707. r=terrence a=lizzard
authorRyan VanderMeulen <ryanvm@gmail.com>
Sat, 19 Mar 2016 15:16:30 -0400
changeset 323536 351882d470a769b8e185deeda24a4ddffb19c105
parent 323535 0bff8f758f624af8d6f4d5fc5061f2c4d1d94898
child 323537 7326d5f35563d93563e0e109defa4a6f895610de
push id5913
push userjlund@mozilla.com
push dateMon, 25 Apr 2016 16:57:49 +0000
treeherdermozilla-beta@dcaf0a6fa115 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersterrence, lizzard
bugs1252707
milestone47.0a2
Bug 1252707. r=terrence a=lizzard MozReview-Commit-ID: EIjq93wa1nD
js/src/vm/Shape.cpp
--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -394,18 +394,20 @@ NativeObject::getChildPropertyOnDictiona
     RootedShape shape(cx);
 
     if (obj->inDictionaryMode()) {
         MOZ_ASSERT(parent == obj->lastProperty());
         shape = child.isAccessorShape() ? Allocate<AccessorShape>(cx) : Allocate<Shape>(cx);
         if (!shape)
             return nullptr;
         if (child.hasSlot() && child.slot() >= obj->lastProperty()->base()->slotSpan()) {
-            if (!obj->setSlotSpan(cx, child.slot() + 1))
+            if (!obj->setSlotSpan(cx, child.slot() + 1)) {
+                new (shape) Shape(obj->lastProperty()->base()->unowned(), 0);
                 return nullptr;
+            }
         }
         shape->initDictionaryShape(child, obj->numFixedSlots(), &obj->shape_);
     }
 
     return shape;
 }
 
 /* static */ Shape*