Changeset 50323 in webkit for trunk/JavaScriptCore

Timestamp:

Oct 30, 2009, 1:13:38 AM (16 years ago)

Author:

[email protected]

Message:

Regression: crash enumerating properties of an object with getters or setters
​https://bugs.webkit.org/show_bug.cgi?id=30948

Reviewed by Gavin Barraclough

Add a guard to prevent us trying to cache property enumeration on
objects with getters or setters.

Location:

trunk/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/JSPropertyNameIterator.cpp (modified) (1 diff)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2009-10-30  Oliver Hunt  <[email protected]>
+
+        Reviewed by Gavin Barraclough.
+
+        Regression: crash enumerating properties of an object with getters or setters
+        https://bugs.webkit.org/show_bug.cgi?id=30948
+
+        Add a guard to prevent us trying to cache property enumeration on
+        objects with getters or setters.
+
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::create):
+
 2009-10-30  Roland Steiner  <[email protected]>
 

trunk/JavaScriptCore/runtime/JSPropertyNameIterator.cpp

@@ -46 +46 @@
     size_t numCacheableSlots = 0;
     if (!o->structure()->hasNonEnumerableProperties() && !o->structure()->hasAnonymousSlots() &&
-        !o->structure()->isUncacheableDictionary() && !o->structure()->typeInfo().overridesGetPropertyNames())
+        !o->structure()->hasGetterSetterProperties() && !o->structure()->isUncacheableDictionary() &&
+        !o->structure()->typeInfo().overridesGetPropertyNames())
         numCacheableSlots = o->structure()->propertyStorageSize();