Closed Bug 513291 Opened 15 years ago Closed 15 years ago

JSOP_INITPROP should insist obj has own scope (JSOP_NEWINIT knows to do this)

Categories

(Core :: JavaScript Engine, defect, P3)

defect

Tracking

()

RESOLVED FIXED
mozilla1.9.3a1

People

(Reporter: brendan, Assigned: brendan)

References

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 file)

See bug 471214 comment 68 et seq.

/be
Attached patch fix (deleted) — Splinter Review
Passes trace-tests -- at least trace-test/tests/basic/testMethodSet.js covers the empty object initialiser in a loop case.

/be
Attachment #420460 - Flags: review?(jorendorff)
Comment on attachment 420460 [details] [diff] [review]
fix

r=me.

In jsops.cpp, case JSOP_NEWINIT, the existing code locks obj around the call to  js_GetMutableScope. That is unnecessary, right?
Attachment #420460 - Flags: review?(jorendorff) → review+
(In reply to comment #2)
> (From update of attachment 420460 [details] [diff] [review])
> r=me.
> 
> In jsops.cpp, case JSOP_NEWINIT, the existing code locks obj around the call to
>  js_GetMutableScope. That is unnecessary, right?

Oh, because the object is newborn-isolated? Yeah, but look at js_GetMutableScope:

JSScope *
js_GetMutableScope(JSContext *cx, JSObject *obj)
{
    JSScope *scope, *newscope;
    JSClass *clasp;
    uint32 freeslot;

    scope = OBJ_SCOPE(obj);
    JS_ASSERT(JS_IS_SCOPE_LOCKED(cx, scope));

/be
http://hg.mozilla.org/tracemonkey/rev/91e31581b670

/be
Status: NEW → ASSIGNED
Priority: -- → P3
Whiteboard: fixed-in-tracemonkey
Target Milestone: --- → mozilla1.9.3a1
http://hg.mozilla.org/mozilla-central/rev/91e31581b670
Status: ASSIGNED → RESOLVED
Closed: 15 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: