# HG changeset patch # User Boris Zbarsky # Date 1369931426 14400 # Node ID f6ab835709d5946a98c77ce7cb283884c3f8f37e # Parent f327a0802164f5607702511bb8890fc633acac8e Bug 876098. Make sure to not skip calling addProperty hooks when objects have them. Otherwise DOM expandos can go AWOL. r=djvj diff --git a/dom/tests/mochitest/bugs/Makefile.in b/dom/tests/mochitest/bugs/Makefile.in --- a/dom/tests/mochitest/bugs/Makefile.in +++ b/dom/tests/mochitest/bugs/Makefile.in @@ -140,11 +140,12 @@ MOCHITEST_FILES = \ test_protochains.html \ test_bug817476.html \ test_bug823173.html \ test_bug850517.html \ test_bug848088.html \ test_resize_move_windows.html \ test_bug862540.html \ test_bug857555.html \ + test_bug876098.html \ $(NULL) include $(topsrcdir)/config/rules.mk diff --git a/dom/tests/mochitest/bugs/test_bug876098.html b/dom/tests/mochitest/bugs/test_bug876098.html new file mode 100644 --- /dev/null +++ b/dom/tests/mochitest/bugs/test_bug876098.html @@ -0,0 +1,52 @@ + + + + + + Test for Bug 876098 + + + + + +Mozilla Bug 876098 +

+ +
+
+ + diff --git a/js/src/ion/IonCaches.cpp b/js/src/ion/IonCaches.cpp --- a/js/src/ion/IonCaches.cpp +++ b/js/src/ion/IonCaches.cpp @@ -2052,16 +2052,21 @@ IsPropertyAddInlineable(JSContext *cx, H RootedShape shape(cx, obj->nativeLookup(cx, id)); if (!shape || shape->inDictionary() || !shape->hasSlot() || !shape->hasDefaultSetter()) return false; // If object has a non-default resolve hook, don't inline if (obj->getClass()->resolve != JS_ResolveStub) return false; + // Likewise for a non-default addProperty hook, since we'll need + // to invoke it. + if (obj->getClass()->addProperty != JS_PropertyStub) + return false; + if (!obj->isExtensible() || !shape->writable()) return false; // walk up the object prototype chain and ensure that all prototypes // are native, and that all prototypes have no getter or setter // defined on the property for (JSObject *proto = obj->getProto(); proto; proto = proto->getProto()) { // if prototype is non-native, don't optimize