Ignore:
Timestamp:
May 21, 2009, 5:28:22 PM (16 years ago)
Author:
[email protected]
Message:

<rdar://problem/6910264> REGRESSION: Cached DOM global object property access fails in browser (25921)
<https://bugs.webkit.org/show_bug.cgi?id=25921>

Reviewed by Maciej Stachowiak.

When caching properties on the global object we need to ensure that we're
not attempting to cache through a shell object.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/JavaScriptCore/jit/JITStubs.cpp

    r43854 r44016  
    17341734    if (globalObject->getPropertySlot(callFrame, ident, slot)) {
    17351735        JSValue result = slot.getValue(callFrame, ident);
    1736         if (slot.isCacheable() && !globalObject->structure()->isDictionary()) {
     1736        if (slot.isCacheable() && !globalObject->structure()->isDictionary() && slot.slotBase() == globalObject) {
    17371737            GlobalResolveInfo& globalResolveInfo = callFrame->codeBlock()->globalResolveInfo(globalResolveInfoIndex);
    17381738            if (globalResolveInfo.structure)
Note: See TracChangeset for help on using the changeset viewer.