Changeset 50323 in webkit for trunk/JavaScriptCore/runtime

Timestamp:

Oct 30, 2009, 1:13:38 AM (16 years ago)

Author:

[email protected]

Message:

Regression: crash enumerating properties of an object with getters or setters
​https://bugs.webkit.org/show_bug.cgi?id=30948

Reviewed by Gavin Barraclough

Add a guard to prevent us trying to cache property enumeration on
objects with getters or setters.

File:

• trunk/JavaScriptCore/runtime/JSPropertyNameIterator.cpp (modified) (1 diff)

trunk/JavaScriptCore/runtime/JSPropertyNameIterator.cpp

@@ -46 +46 @@
     size_t numCacheableSlots = 0;
     if (!o->structure()->hasNonEnumerableProperties() && !o->structure()->hasAnonymousSlots() &&
-        !o->structure()->isUncacheableDictionary() && !o->structure()->typeInfo().overridesGetPropertyNames())
+        !o->structure()->hasGetterSetterProperties() && !o->structure()->isUncacheableDictionary() &&
+        !o->structure()->typeInfo().overridesGetPropertyNames())
         numCacheableSlots = o->structure()->propertyStorageSize();