Closed Bug 935324 Opened 10 years ago Closed 10 years ago

Clean up adding of type properties to objects

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
macOS
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla28

People

(Reporter: bhackett1024, Assigned: bhackett1024)

References

Details

(Whiteboard: [qa-])

Attachments

(1 file)

patch
40.53 KB, patch
jandem
: review+
Details | Diff | Splinter Review
Attached patch patch — — Splinter Review 
Right now AddTypePropertyId is called as something of an overapproximation in the VM side effect cases --- even if a property set or define fails then the object might still get the property type.  IonBuilder now relies on object type information being accurate, so that it can determine whether an object has an 'own' property and the possible types of that property for globals (which may have undefined properties not reflected in type information).  This seems to have been the cause of bug 933734, as cleaning these calls up seems to eliminate the crash in that bug.
Attachment #827744 - Flags: review?(jdemooij)
Blocks: 785905
Attachment #827744 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/f0f6a25259c5
Assignee: nobody → bhackett1024
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
Whiteboard: [qa-]
You need to log in before you can comment on or make changes to this bug.