Bug 1547129 - Change JSOP_INITPROP implementation to DefineDataProperty. r=jorendorff
authorAshley Hauck <khyperia@mozilla.com>
Fri, 10 May 2019 19:21:45 +0000
changeset 532270 a5fe44cee7723c38287dd5e4f5d04d335260bcb5
parent 532269 8096d130b1346ba0c6bc10450de6f86196f3f768
child 532271 a0efb14b79726f577beced5b0ef8f9e6419115ca
push id11265
push userffxbld-merge
push dateMon, 13 May 2019 10:53:39 +0000
treeherdermozilla-beta@77e0fe8dbdd3 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjorendorff
bugs1547129
milestone68.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1547129 - Change JSOP_INITPROP implementation to DefineDataProperty. r=jorendorff Differential Revision: https://phabricator.services.mozilla.com/D29069
js/src/jit-test/tests/fields/bug1547129.js
js/src/vm/Interpreter-inl.h
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/fields/bug1547129.js
@@ -0,0 +1,21 @@
+// |jit-test| --enable-experimental-fields
+
+load(libdir + "asserts.js");
+
+new class foo extends Array {
+  e = function() {}
+}
+
+source = `new class bar extends Promise { e = function() {} }`;
+// Calling the Promise constructor with empty args fails with TypeError.
+assertThrowsInstanceOf(() => eval(source), TypeError);
+
+class Base {
+  constructor() {
+    return new Proxy({}, {});
+  }
+}
+
+new class prox extends Base {
+  e = function () {}
+}
--- a/js/src/vm/Interpreter-inl.h
+++ b/js/src/vm/Interpreter-inl.h
@@ -353,20 +353,18 @@ inline void InitGlobalLexicalOperation(J
   MOZ_ASSERT(IsUninitializedLexical(lexicalEnv->getSlot(shape->slot())));
 
   // Don't treat the initial assignment to global lexicals as overwrites.
   lexicalEnv->setSlotWithType(cx, shape, value, /* overwriting = */ false);
 }
 
 inline bool InitPropertyOperation(JSContext* cx, JSOp op, HandleObject obj,
                                   HandlePropertyName name, HandleValue rhs) {
-  MOZ_ASSERT(obj->is<PlainObject>() || obj->is<JSFunction>());
   unsigned propAttrs = GetInitDataPropAttrs(op);
-  return NativeDefineDataProperty(cx, obj.as<NativeObject>(), name, rhs,
-                                  propAttrs);
+  return DefineDataProperty(cx, obj, name, rhs, propAttrs);
 }
 
 static MOZ_ALWAYS_INLINE bool NegOperation(JSContext* cx,
                                            MutableHandleValue val,
                                            MutableHandleValue res) {
   /*
    * When the operand is int jsval, INT32_FITS_IN_JSVAL(i) implies
    * INT32_FITS_IN_JSVAL(-i) unless i is 0 or INT32_MIN when the