Closed
Bug 1072260
Opened 10 years ago
Closed 10 years ago
obj->shadowingShapeChange is called twice in PurgeProtoChain()
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: jonco, Assigned: jonco)
Details
Attachments
(1 file)
|
1.49 KB,
patch
|
jorendorff
:
review+
|
Details | Diff | Splinter Review |
I don't understand this code that well, but the duplicate call of shadowingShapeChange in PurgeProtoChain() looks wrong:
if (shape) {
if (!obj->shadowingShapeChange(cx, *shape))
return false;
obj->shadowingShapeChange(cx, *shape);
return true;
}
http://dxr.mozilla.org/mozilla-central/source/js/src/jsobj.cpp#3943
|
Assignee | |
Comment 1•10 years ago
|
||
Patch to remove second call, passes tests. I removed the call to shadowingShapeChange completely to see what would happen and none of the jit-tests failed, so I added a one that exercises this.
Assignee: nobody → jcoppeard
Attachment #8494488 -
Flags: review?(jorendorff)
|
||
Updated•10 years ago
|
Attachment #8494488 -
Flags: review?(jorendorff) → review+
|
|
Assignee | |
Comment 2•10 years ago
|
||
...and it looks like this already got fixed as part of bug 1073842.
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → WORKSFORME
You need to log in
before you can comment on or make changes to this bug.
Description
•