Commit ba939ce2 authored by oliver@apple.com's avatar oliver@apple.com

Regression: crash enumerating properties of an object with getters or setters

https://bugs.webkit.org/show_bug.cgi?id=30948

Reviewed by Gavin Barraclough

Add a guard to prevent us trying to cache property enumeration on
objects with getters or setters.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@50323 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 030b86fb
2009-10-30 Oliver Hunt <oliver@apple.com>
Reviewed by Gavin Barraclough.
Regression: crash enumerating properties of an object with getters or setters
https://bugs.webkit.org/show_bug.cgi?id=30948
Add a guard to prevent us trying to cache property enumeration on
objects with getters or setters.
* runtime/JSPropertyNameIterator.cpp:
(JSC::JSPropertyNameIterator::create):
2009-10-30 Roland Steiner <rolandsteiner@chromium.org>
Reviewed by Eric Seidel.
......
......@@ -45,7 +45,8 @@ JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSObject
o->getPropertyNames(exec, propertyNames);
size_t numCacheableSlots = 0;
if (!o->structure()->hasNonEnumerableProperties() && !o->structure()->hasAnonymousSlots() &&
!o->structure()->isUncacheableDictionary() && !o->structure()->typeInfo().overridesGetPropertyNames())
!o->structure()->hasGetterSetterProperties() && !o->structure()->isUncacheableDictionary() &&
!o->structure()->typeInfo().overridesGetPropertyNames())
numCacheableSlots = o->structure()->propertyStorageSize();
JSPropertyNameIterator* jsPropertyNameIterator = new (exec) JSPropertyNameIterator(exec, propertyNames.data(), numCacheableSlots);
......
2009-10-30 Oliver Hunt <oliver@apple.com>
Reviewed by Gavin Barraclough.
Regression: crash enumerating properties of an object with getters or setters
https://bugs.webkit.org/show_bug.cgi?id=30948
Add test for enumerating getters and setters.
* fast/js/for-in-cached-expected.txt:
* fast/js/script-tests/for-in-cached.js:
(forIn5):
2009-10-29 Erik Arvidsson <arv@chromium.org>
Reviewed by Eric Seidel.
......@@ -10,6 +10,9 @@ PASS forIn3({ y2 : 2, __proto__: null }) is ['x', 'y2']
PASS forIn3({ __proto__: { __proto__: { y3 : 2 } } }) is ['x', 'y3']
PASS forIn4(objectWithArrayAsProto) is []
PASS forIn4(objectWithArrayAsProto) is ['0']
PASS forIn5({get foo() { return 'called getter'} }) is ['foo', 'called getter']
PASS forIn5({set foo() { } }) is ['foo', undefined]
PASS forIn5({get foo() { return 'called getter'}, set foo() { }}) is ['foo', 'called getter']
PASS successfullyParsed is true
TEST COMPLETE
......
......@@ -55,4 +55,14 @@ shouldBe("forIn4(objectWithArrayAsProto)", "[]");
objectWithArrayAsProto.__proto__[0]=1;
shouldBe("forIn4(objectWithArrayAsProto)", "['0']");
function forIn5(o) {
for (var i in o)
return [i, o[i]];
}
shouldBe("forIn5({get foo() { return 'called getter'} })", "['foo', 'called getter']");
shouldBe("forIn5({set foo() { } })", "['foo', undefined]");
shouldBe("forIn5({get foo() { return 'called getter'}, set foo() { }})", "['foo', 'called getter']");
var successfullyParsed = true;
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment