obj->shadowingShapeChange is called twice in PurgeProtoChain()

RESOLVED WORKSFORME

Status

()

Core
JavaScript Engine
RESOLVED WORKSFORME
3 years ago
3 years ago

People

(Reporter: jonco, Assigned: jonco)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

3 years ago
I don't understand this code that well, but the duplicate call of shadowingShapeChange in PurgeProtoChain() looks wrong:

        if (shape) {
            if (!obj->shadowingShapeChange(cx, *shape))
                return false;

            obj->shadowingShapeChange(cx, *shape);
            return true;
        }

http://dxr.mozilla.org/mozilla-central/source/js/src/jsobj.cpp#3943
(Assignee)

Comment 1

3 years ago
Created attachment 8494488 [details] [diff] [review]
purge-proto-chain

Patch to remove second call, passes tests.

I removed the call to shadowingShapeChange completely to see what would happen and none of the jit-tests failed, so I added a one that exercises this.
Assignee: nobody → jcoppeard
Attachment #8494488 - Flags: review?(jorendorff)
Attachment #8494488 - Flags: review?(jorendorff) → review+
(Assignee)

Comment 2

3 years ago
...and it looks like this already got fixed as part of bug 1073842.
Status: NEW → RESOLVED
Last Resolved: 3 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.