Closed Bug 935324 Opened 6 years ago Closed 6 years ago

Clean up adding of type properties to objects

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set

Tracking

()

RESOLVED FIXED
mozilla28

People

(Reporter: bhackett, Assigned: bhackett)

References

Details

(Whiteboard: [qa-])

Attachments

(1 file)

Attached patch patchSplinter Review
Right now AddTypePropertyId is called as something of an overapproximation in the VM side effect cases --- even if a property set or define fails then the object might still get the property type.  IonBuilder now relies on object type information being accurate, so that it can determine whether an object has an 'own' property and the possible types of that property for globals (which may have undefined properties not reflected in type information).  This seems to have been the cause of bug 933734, as cleaning these calls up seems to eliminate the crash in that bug.
Attachment #827744 - Flags: review?(jdemooij)
Blocks: 785905
Attachment #827744 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/f0f6a25259c5
Assignee: nobody → bhackett1024
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
Depends on: 936361
Depends on: 936854
Whiteboard: [qa-]
Depends on: 996895
You need to log in before you can comment on or make changes to this bug.