Changeset 48331 in webkit for trunk/JavaScriptCore/runtime/JSVariableObject.h

Timestamp:

Sep 11, 2009, 9:52:39 PM (16 years ago)

Author:

[email protected]

Message:

getPropertyNames caching is invalid when the prototype chain contains objects with custom getPropertyNames
​https://bugs.webkit.org/show_bug.cgi?id=29214

Reviewed by Sam Weinig.

Add a flag to TypeInfo to indicate whether a type overrides getPropertyNames.
This flag is used to make sure that caching of the property name data is safe.

File:

• trunk/JavaScriptCore/runtime/JSVariableObject.h (modified) (1 diff)

trunk/JavaScriptCore/runtime/JSVariableObject.h

@@ -59 +59 @@
         Register& registerAt(int index) const { return d->registers[index]; }
 
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        {
+            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark));
+        }
+        
     protected:
         // Subclasses of JSVariableObject can subclass this struct to add data