Backed out changeset 33573c52d0e8 (bug 1285213) for bustage. FIREFOX_50_0b5_BUILD1 FIREFOX_50_0b5_RELEASE
authorRyan VanderMeulen <ryanvm@gmail.com>
Thu, 06 Oct 2016 13:54:35 -0400
changeset 348534 49776d31766dd130969f9ec4ea3354a43e8e6d9d
parent 348533 b9a54c39bedd819d6e1599a47e5dfb619a9f73eb
child 348535 5a5fc43f88e40f423cd052b2b537761a6a492da8
push id6465
push userryanvm@gmail.com
push dateThu, 06 Oct 2016 17:54:44 +0000
treeherdermozilla-beta@49776d31766d [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1285213
milestone50.0
backs out33573c52d0e81ac59f8b4b8ef74b7e1333a0878d
Backed out changeset 33573c52d0e8 (bug 1285213) for bustage.
js/src/jit-test/tests/debug/Frame-eval-32.js
js/src/jsobj.cpp
js/src/vm/Interpreter-inl.h
deleted file mode 100644
--- a/js/src/jit-test/tests/debug/Frame-eval-32.js
+++ /dev/null
@@ -1,8 +0,0 @@
-// |jit-test| error: ReferenceError
-
-// Test the TDZ works for glbao lexicals through Debugger environments in
-// compound assignments.
-load(libdir + "evalInFrame.js");
-
-evalInFrame(0, "x |= 0");
-let x;
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -2225,32 +2225,17 @@ js::LookupNameUnqualified(JSContext* cx,
         if (!LookupProperty(cx, scope, id, &pobj, &shape))
             return false;
         if (shape)
             break;
     }
 
     // See note above RuntimeLexicalErrorObject.
     if (pobj == scope) {
-        bool isTDZ = false;
-        if (shape && name != cx->names().dotThis) {
-            // Treat Debugger environments specially for TDZ checks, as they
-            // look like non-native environments but in fact wrap native
-            // environments.
-            if (scope->is<DebugEnvironmentProxy>()) {
-                RootedValue v(cx);
-                if (!scope->as<DebugEnvironmentProxy>().getMaybeSentinelValue(cx, id, &v))
-                    return false;
-                isTDZ = IsUninitializedLexical(v);
-            } else {
-                isTDZ = IsUninitializedLexicalSlot(scope, shape);
-            }
-        }
-
-        if (isTDZ) {
+        if (name != cx->names().dotThis && IsUninitializedLexicalSlot(scope, shape)) {
             scope = RuntimeLexicalErrorObject::create(cx, scope, JSMSG_UNINITIALIZED_LEXICAL);
             if (!scope)
                 return false;
         } else if (scope->is<ScopeObject>() && !scope->is<DeclEnvObject>() && !shape->writable()) {
             MOZ_ASSERT(name != cx->names().dotThis);
             scope = RuntimeLexicalErrorObject::create(cx, scope, JSMSG_BAD_CONST_ASSIGN);
             if (!scope)
                 return false;
--- a/js/src/vm/Interpreter-inl.h
+++ b/js/src/vm/Interpreter-inl.h
@@ -76,24 +76,24 @@ IsUninitializedLexical(const Value& val)
 {
     // Use whyMagic here because JS_OPTIMIZED_ARGUMENTS could flow into here.
     return val.isMagic() && val.whyMagic() == JS_UNINITIALIZED_LEXICAL;
 }
 
 static inline bool
 IsUninitializedLexicalSlot(HandleObject obj, HandleShape shape)
 {
-    MOZ_ASSERT(shape);
     if (obj->is<DynamicWithObject>())
         return false;
     // We check for IsImplicitDenseOrTypedArrayElement even though the shape
     // is always a non-indexed property because proxy hooks may return a
     // "non-native property found" shape, which happens to be encoded in the
     // same way as the "dense element" shape. See MarkNonNativePropertyFound.
-    if (IsImplicitDenseOrTypedArrayElement(shape) ||
+    if (!shape ||
+        IsImplicitDenseOrTypedArrayElement(shape) ||
         !shape->hasSlot() ||
         !shape->hasDefaultGetter() ||
         !shape->hasDefaultSetter())
     {
         return false;
     }
     MOZ_ASSERT(obj->as<NativeObject>().containsPure(shape));
     return IsUninitializedLexical(obj->as<NativeObject>().getSlot(shape->slot()));