Changeset 44016 in webkit for trunk/JavaScriptCore/jit/JITStubs.cpp

Timestamp:

May 21, 2009, 5:28:22 PM (16 years ago)

Author:

[email protected]

Message:

<rdar://problem/6910264> REGRESSION: Cached DOM global object property access fails in browser (25921)
<​https://bugs.webkit.org/show_bug.cgi?id=25921>

Reviewed by Maciej Stachowiak.

When caching properties on the global object we need to ensure that we're
not attempting to cache through a shell object.

File:

• trunk/JavaScriptCore/jit/JITStubs.cpp (modified) (1 diff)

trunk/JavaScriptCore/jit/JITStubs.cpp

@@ -1734 +1734 @@
     if (globalObject->getPropertySlot(callFrame, ident, slot)) {
         JSValue result = slot.getValue(callFrame, ident);
-        if (slot.isCacheable() && !globalObject->structure()->isDictionary()) {
+        if (slot.isCacheable() && !globalObject->structure()->isDictionary() && slot.slotBase() == globalObject) {
             GlobalResolveInfo& globalResolveInfo = callFrame->codeBlock()->globalResolveInfo(globalResolveInfoIndex);
             if (globalResolveInfo.structure)