Closed
Bug 454266
Opened 17 years ago
Closed 17 years ago
js_FillPropertyCache uses the wrong scope's shape sometimes
Categories
(Core :: JavaScript Engine, defect, P1)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla1.9.1b1
People
(Reporter: brendan, Assigned: brendan)
References
Details
Attachments
(1 file)
|
964 bytes,
patch
|
mrbkap
:
review+
|
Details | Diff | Splinter Review |
The patch for bug 445899 lost the obj == pobj condition guarding the update of kshape (the filled entry's "key shape") from scope->shape (where scope is always OBJ_SCOPE(pobj)). This is bad, it happens to help cases where the got property is direct, but it guarantees a miss for indirect properties.
/be
|
Assignee | |
Updated•17 years ago
|
Priority: -- → P1
Target Milestone: --- → mozilla1.9.1b1
|
|
Assignee | |
Comment 1•17 years ago
|
||
shaver's out sick, need to get this in. It exposes the rest of my arguments work being undone when I test v8/raytrace.js with this plus three other patches, but that's a good sign.
Passes the js testsuit with same failures as without.
/be
Attachment #337538 -
Flags: review?(mrbkap)
|
||
Updated•17 years ago
|
Attachment #337538 -
Flags: review?(mrbkap) → review+
|
|
Assignee | |
Comment 2•17 years ago
|
||
Fixed:
http://hg.mozilla.org/tracemonkey/rev/728cf8bf1648
http://hg.mozilla.org/mozilla-central/rev/71c48ddc9e8c
/be
Status: ASSIGNED → RESOLVED
Closed: 17 years ago
Resolution: --- → FIXED
|
||
Updated•17 years ago
|
Flags: in-testsuite-
Flags: in-litmus-
You need to log in
before you can comment on or make changes to this bug.
Description
•