Bug 913716 - Properly check for undefined setters in SetPropertyIC. (r=djvj)
authorEric Faust <efaustbmo@gmail.com>
Tue, 10 Sep 2013 16:01:36 -0700
changeset 159372 a512b89b44ebe2c006f40deb1a0dd59f4e73d485
parent 159371 7412a3a5f4cceea99d3677fd2526975f9198fd83
child 159373 d0a0127e099e03a7ff9ad32b8616260b19a09429
push id2961
push userlsblakk@mozilla.com
push dateMon, 28 Oct 2013 21:59:28 +0000
treeherdermozilla-beta@73ef4f13486f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdjvj
bugs913716
milestone26.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 913716 - Properly check for undefined setters in SetPropertyIC. (r=djvj)
js/src/jit/IonCaches.cpp
--- a/js/src/jit/IonCaches.cpp
+++ b/js/src/jit/IonCaches.cpp
@@ -2019,17 +2019,18 @@ static bool
 IsCacheableSetPropCallNative(HandleObject obj, HandleObject holder, HandleShape shape)
 {
     if (!obj->isNative())
         return false;
 
     if (!shape || !IsCacheableProtoChain(obj, holder))
         return false;
 
-    return shape->hasSetterValue() && shape->setterObject()->is<JSFunction>() &&
+    return shape->hasSetterValue() && shape->setterObject() &&
+           shape->setterObject()->is<JSFunction>() &&
            shape->setterObject()->as<JSFunction>().isNative();
 }
 
 static bool
 IsCacheableSetPropCallPropertyOp(HandleObject obj, HandleObject holder,
                                  HandleShape shape)
 {
     if (!obj->isNative())