diff options
| author | Brian Hackett <bhackett1024@gmail.com> | 2018-02-23 13:25:53 -0500 |
|---|---|---|
| committer | wolfbeast <mcwerewolf@gmail.com> | 2018-03-14 11:08:45 +0100 |
| commit | 69d5d1e702024e584536c88a5d604889c5bcd14d (patch) | |
| tree | cf40f9ad38ef25b2110a9aae1ff9ef9cfa629dfb /js/src | |
| parent | 9da00ab58ed6af96a160c848f86b2db2c0dff547 (diff) | |
| download | UXP-69d5d1e702024e584536c88a5d604889c5bcd14d.tar UXP-69d5d1e702024e584536c88a5d604889c5bcd14d.tar.gz UXP-69d5d1e702024e584536c88a5d604889c5bcd14d.tar.lz UXP-69d5d1e702024e584536c88a5d604889c5bcd14d.tar.xz UXP-69d5d1e702024e584536c88a5d604889c5bcd14d.zip | |
Bug 1437507 - Fix JSObject::setFlags to call ensureShape before checking for dictionary mode. r=jandem, a=RyanVM
--HG--
extra : source : ca6b74831ec3db204e024b07f200b0d1ce93557e
extra : intermediate-source : 9d7c295d9570e294851908465f56ec0779547d2a
Diffstat (limited to 'js/src')
| -rw-r--r-- | js/src/vm/Shape.cpp | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/js/src/vm/Shape.cpp b/js/src/vm/Shape.cpp index a64dc529a..306a2c540 100644 --- a/js/src/vm/Shape.cpp +++ b/js/src/vm/Shape.cpp @@ -1214,6 +1214,10 @@ JSObject::setFlags(ExclusiveContext* cx, BaseShape::Flag flags, GenerateShape ge RootedObject self(cx, this); + Shape* existingShape = self->ensureShape(cx); + if (!existingShape) + return false; + if (isNative() && as<NativeObject>().inDictionaryMode()) { if (generateShape == GENERATE_SHAPE && !as<NativeObject>().generateOwnShape(cx)) return false; @@ -1227,10 +1231,6 @@ JSObject::setFlags(ExclusiveContext* cx, BaseShape::Flag flags, GenerateShape ge return true; } - Shape* existingShape = self->ensureShape(cx); - if (!existingShape) - return false; - Shape* newShape = Shape::setObjectFlags(cx, flags, self->taggedProto(), existingShape); if (!newShape) return false; |