diff options
| author | Mark Hahnenberg <mhahnenberg@apple.com> | 2013-07-01 15:46:30 +0200 |
|---|---|---|
| committer | The Qt Project <gerrit-noreply@qt-project.org> | 2013-07-01 16:22:37 +0200 |
| commit | 86a59036393fb081f094325518205e6c6067b05e (patch) | |
| tree | 4e6babf2f14af13dc4e67592d5c3e6f32e5a5e80 /Source/JavaScriptCore/API/JSWeakObjectMapRefInternal.h | |
| parent | 55e3e0bb1d8b1487df36219869ef5bd302b8640c (diff) | |
| download | qtwebkit-86a59036393fb081f094325518205e6c6067b05e.tar.gz | |
JSObject::getOwnNonIndexPropertyNames calculates numCacheableSlots incorrectly (2/2)
https://bugs.webkit.org/show_bug.cgi?id=114235
Reviewed by Filip Pizlo.
If the object doesn't have any properties but the prototype does, we'll assume those prototype properties are
accessible in the base object's backing store, which is bad.
Source/JavaScriptCore:
* runtime/JSObject.cpp:
(JSC::JSObject::getPropertyNames):
(JSC::JSObject::getOwnNonIndexPropertyNames):
* runtime/PropertyNameArray.h:
(JSC::PropertyNameArray::PropertyNameArray):
(JSC::PropertyNameArray::setNumCacheableSlotsForObject):
(JSC::PropertyNameArray::setBaseObject):
(PropertyNameArray):
Change-Id: If61b609438fa1d62364bac556af635413198d8ad
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@148142 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Jocelyn Turcotte <jocelyn.turcotte@digia.com>
Diffstat (limited to 'Source/JavaScriptCore/API/JSWeakObjectMapRefInternal.h')
0 files changed, 0 insertions, 0 deletions