From 14ed45b0dae9606152095aac6624a1f003b166af Mon Sep 17 00:00:00 2001 From: Chris Leary Date: Mon, 9 Aug 2010 19:11:24 -0700 Subject: [PATCH] Bug 585341: fix non-default-getter on with in IC. (r=dvander) --- js/src/methodjit/PolyIC.cpp | 5 ++++- js/src/trace-test/tests/jaeger/bug585341.js | 7 +++++++ 2 files changed, 11 insertions(+), 1 deletion(-) create mode 100644 js/src/trace-test/tests/jaeger/bug585341.js diff --git a/js/src/methodjit/PolyIC.cpp b/js/src/methodjit/PolyIC.cpp index faf497c2e5..309d7195c6 100644 --- a/js/src/methodjit/PolyIC.cpp +++ b/js/src/methodjit/PolyIC.cpp @@ -2163,7 +2163,10 @@ ic::Name(VMFrame &f, uint32 index) THROW(); } JSScopeProperty *sprop = (JSScopeProperty *)cc.prop; - NATIVE_GET(f.cx, cc.obj, cc.holder, sprop, JSGET_METHOD_BARRIER, &rval, + JSObject *normalized = cc.obj; + if (cc.obj->getClass() == &js_WithClass && !sprop->hasDefaultGetter()) + normalized = js_UnwrapWithObject(f.cx, cc.obj); + NATIVE_GET(f.cx, normalized, cc.holder, sprop, JSGET_METHOD_BARRIER, &rval, THROW()); JS_UNLOCK_OBJ(f.cx, cc.holder); } diff --git a/js/src/trace-test/tests/jaeger/bug585341.js b/js/src/trace-test/tests/jaeger/bug585341.js new file mode 100644 index 0000000000..5de5111078 --- /dev/null +++ b/js/src/trace-test/tests/jaeger/bug585341.js @@ -0,0 +1,7 @@ +// |trace-test| error: invalid arguments +__defineGetter__("x", Float64Array) +Function("\ + with(this) {\ + eval(\"x\")\ + }\ +")() -- 2.11.4.GIT