Bug 585341: fix non-default-getter on with in IC. (r=dvander)
authorChris Leary <cdleary@mozilla.com>
Mon, 09 Aug 2010 19:11:24 -0700
changeset 53360 d2e1278023fbac89cb81adfc4ba215a8b0f430c2
parent 53359 4546e4c7427c70da01c007324a779cdce8a37da6
child 53361 498661f34c018cab2665b9ca89458b5701c0665a
push id1
push userroot
push dateTue, 26 Apr 2011 22:38:44 +0000
treeherdermozilla-beta@bfdb6e623a36 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdvander
bugs585341
milestone2.0b4pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 585341: fix non-default-getter on with in IC. (r=dvander)
js/src/methodjit/PolyIC.cpp
js/src/trace-test/tests/jaeger/bug585341.js
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -2158,17 +2158,20 @@ ic::Name(VMFrame &f, uint32 index)
             if (op2 == JSOP_TYPEOF) {
                 f.regs.sp[0].setUndefined();
                 return;
             }
             ReportAtomNotDefined(f.cx, atom);
             THROW();
         }
         JSScopeProperty *sprop = (JSScopeProperty *)cc.prop;
-        NATIVE_GET(f.cx, cc.obj, cc.holder, sprop, JSGET_METHOD_BARRIER, &rval,
+        JSObject *normalized = cc.obj;
+        if (cc.obj->getClass() == &js_WithClass && !sprop->hasDefaultGetter())
+            normalized = js_UnwrapWithObject(f.cx, cc.obj);
+        NATIVE_GET(f.cx, normalized, cc.holder, sprop, JSGET_METHOD_BARRIER, &rval,
                    THROW());
         JS_UNLOCK_OBJ(f.cx, cc.holder);
     }
 
     f.regs.sp[0] = rval;
 }
 
 static void JS_FASTCALL
new file mode 100644
--- /dev/null
+++ b/js/src/trace-test/tests/jaeger/bug585341.js
@@ -0,0 +1,7 @@
+// |trace-test| error: invalid arguments
+__defineGetter__("x", Float64Array)
+Function("\
+  with(this) {\
+    eval(\"x\")\
+  }\
+")()