Closed
Bug 513291
Opened 15 years ago
Closed 15 years ago
JSOP_INITPROP should insist obj has own scope (JSOP_NEWINIT knows to do this)
Categories
(Core :: JavaScript Engine, defect, P3)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla1.9.3a1
People
(Reporter: brendan, Assigned: brendan)
References
Details
(Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file)
(deleted),
patch
|
jorendorff
:
review+
|
Details | Diff | Splinter Review |
See bug 471214 comment 68 et seq. /be
Assignee | ||
Comment 1•15 years ago
|
||
Passes trace-tests -- at least trace-test/tests/basic/testMethodSet.js covers the empty object initialiser in a loop case. /be
Attachment #420460 -
Flags: review?(jorendorff)
Comment 2•15 years ago
|
||
Comment on attachment 420460 [details] [diff] [review] fix r=me. In jsops.cpp, case JSOP_NEWINIT, the existing code locks obj around the call to js_GetMutableScope. That is unnecessary, right?
Attachment #420460 -
Flags: review?(jorendorff) → review+
Assignee | ||
Comment 3•15 years ago
|
||
(In reply to comment #2) > (From update of attachment 420460 [details] [diff] [review]) > r=me. > > In jsops.cpp, case JSOP_NEWINIT, the existing code locks obj around the call to > js_GetMutableScope. That is unnecessary, right? Oh, because the object is newborn-isolated? Yeah, but look at js_GetMutableScope: JSScope * js_GetMutableScope(JSContext *cx, JSObject *obj) { JSScope *scope, *newscope; JSClass *clasp; uint32 freeslot; scope = OBJ_SCOPE(obj); JS_ASSERT(JS_IS_SCOPE_LOCKED(cx, scope)); /be
Assignee | ||
Comment 4•15 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/91e31581b670 /be
Status: NEW → ASSIGNED
Priority: -- → P3
Whiteboard: fixed-in-tracemonkey
Target Milestone: --- → mozilla1.9.3a1
Comment 5•15 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/91e31581b670
Status: ASSIGNED → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•