summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorBrian Hackett <bhackett1024@gmail.com>2018-02-23 13:25:53 -0500
committerwolfbeast <mcwerewolf@gmail.com>2018-03-14 11:08:45 +0100
commit69d5d1e702024e584536c88a5d604889c5bcd14d (patch)
treecf40f9ad38ef25b2110a9aae1ff9ef9cfa629dfb
parent9da00ab58ed6af96a160c848f86b2db2c0dff547 (diff)
downloadUXP-69d5d1e702024e584536c88a5d604889c5bcd14d.tar
UXP-69d5d1e702024e584536c88a5d604889c5bcd14d.tar.gz
UXP-69d5d1e702024e584536c88a5d604889c5bcd14d.tar.lz
UXP-69d5d1e702024e584536c88a5d604889c5bcd14d.tar.xz
UXP-69d5d1e702024e584536c88a5d604889c5bcd14d.zip
Bug 1437507 - Fix JSObject::setFlags to call ensureShape before checking for dictionary mode. r=jandem, a=RyanVM
--HG-- extra : source : ca6b74831ec3db204e024b07f200b0d1ce93557e extra : intermediate-source : 9d7c295d9570e294851908465f56ec0779547d2a
-rw-r--r--js/src/vm/Shape.cpp8
1 files changed, 4 insertions, 4 deletions
diff --git a/js/src/vm/Shape.cpp b/js/src/vm/Shape.cpp
index a64dc529a..306a2c540 100644
--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -1214,6 +1214,10 @@ JSObject::setFlags(ExclusiveContext* cx, BaseShape::Flag flags, GenerateShape ge
RootedObject self(cx, this);
+ Shape* existingShape = self->ensureShape(cx);
+ if (!existingShape)
+ return false;
+
if (isNative() && as<NativeObject>().inDictionaryMode()) {
if (generateShape == GENERATE_SHAPE && !as<NativeObject>().generateOwnShape(cx))
return false;
@@ -1227,10 +1231,6 @@ JSObject::setFlags(ExclusiveContext* cx, BaseShape::Flag flags, GenerateShape ge
return true;
}
- Shape* existingShape = self->ensureShape(cx);
- if (!existingShape)
- return false;
-
Shape* newShape = Shape::setObjectFlags(cx, flags, self->taggedProto(), existingShape);
if (!newShape)
return false;