Bug 1406398 - Avoid rooting the object twice in EnumerableOwnProperties. r=jandem
authorAndré Bargull <andre.bargull@gmail.com>
Thu, 12 Oct 2017 09:20:07 -0700
changeset 430889 c2cecb6d6f9bb85f258a66cf8e94c1860adde7e5
parent 430888 a3785ec9a48c8c76dd98b5c5140283f8ac44c851
child 430890 c2bdce9b76f2135fd100f073b6ccaf8bb9a69fed
push id108
push userfmarier@mozilla.com
push dateFri, 03 Nov 2017 18:37:44 +0000
reviewersjandem
bugs1406398
milestone58.0a1
Bug 1406398 - Avoid rooting the object twice in EnumerableOwnProperties. r=jandem
js/src/builtin/Object.cpp
--- a/js/src/builtin/Object.cpp
+++ b/js/src/builtin/Object.cpp
@@ -1137,36 +1137,34 @@ EnumerableOwnProperties(JSContext* cx, c
     AutoValueVector properties(cx);
     size_t len = ids.length();
     if (!properties.resize(len))
         return false;
 
     RootedId id(cx);
     RootedValue key(cx);
     RootedValue value(cx);
-    RootedNativeObject nobj(cx);
-    if (obj->is<NativeObject>())
-        nobj = &obj->as<NativeObject>();
     RootedShape shape(cx);
     Rooted<PropertyDescriptor> desc(cx);
     // Step 4.
     size_t out = 0;
     for (size_t i = 0; i < len; i++) {
         id = ids[i];
 
         // Step 4.a. (Symbols were filtered out in step 2.)
         MOZ_ASSERT(!JSID_IS_SYMBOL(id));
 
         if (kind != Values) {
             if (!IdToStringOrSymbol(cx, id, &key))
                 return false;
         }
 
         // Step 4.a.i.
-        if (nobj) {
+        if (obj->is<NativeObject>()) {
+            HandleNativeObject nobj = obj.as<NativeObject>();
             if (JSID_IS_INT(id) && nobj->containsDenseElement(JSID_TO_INT(id))) {
                 value = nobj->getDenseOrTypedArrayElement(JSID_TO_INT(id));
             } else {
                 shape = nobj->lookup(cx, id);
                 if (!shape || !(shape->attributes() & JSPROP_ENUMERATE))
                     continue;
                 if (!shape->isAccessorShape()) {
                     if (!NativeGetExistingProperty(cx, nobj, nobj, shape, &value))