Changeset 48331 in webkit for trunk/JavaScriptCore/runtime/NumberObject.h

Timestamp:

Sep 11, 2009, 9:52:39 PM (16 years ago)

Author:

[email protected]

Message:

getPropertyNames caching is invalid when the prototype chain contains objects with custom getPropertyNames
​https://bugs.webkit.org/show_bug.cgi?id=29214

Reviewed by Sam Weinig.

Add a flag to TypeInfo to indicate whether a type overrides getPropertyNames.
This flag is used to make sure that caching of the property name data is safe.

File:

• trunk/JavaScriptCore/runtime/NumberObject.h (modified) (1 diff)

trunk/JavaScriptCore/runtime/NumberObject.h

@@ -34 +34 @@
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot));
+            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultGetPropertyNames));
         }
 #else
         static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
-            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark));
+            return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot | HasDefaultMark | HasDefaultGetPropertyNames));
         }
 #endif