Wed, 31 Dec 2014 06:09:35 +0100
Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.
1 /*
2 * Any copyright is dedicated to the Public Domain.
3 * http://creativecommons.org/licenses/publicdomain/
4 */
6 function make_watcher(name) {
7 return function (id, oldv, newv) {
8 print("watched " + name + "[0]");
9 };
10 }
12 var o, p;
13 function f(flag) {
14 if (flag) {
15 o = arguments;
16 } else {
17 p = arguments;
18 o.watch(0, make_watcher('o'));
19 p.watch(0, make_watcher('p'));
21 /*
22 * Previously, the watchpoint implementation actually substituted its magic setter
23 * functions for the setters of shared shapes, and then 1) carefully ignored calls
24 * to its magic setter from unrelated objects, and 2) avoided restoring the
25 * original setter until all watchpoints on that shape had been removed.
26 *
27 * However, when the watchpoint code began using JSObject::changeProperty and
28 * js_ChangeNativePropertyAttrs to change shapes' setters, the shape tree code
29 * became conscious of the presence of watchpoints, and shared shapes between
30 * objects only when their watchpoint nature coincided. Clearing the magic setter
31 * from one object's shape would not affect other objects, because the
32 * watchpointed and non-watchpointed shapes were distinct if they were shared.
33 *
34 * Thus, the first unwatch call must go ahead and fix p's shape, even though a
35 * watchpoint exists on the same shape in o. o's watchpoint's presence shouldn't
36 * cause 'unwatch' to leave p's magic setter in place.
37 */
39 /* DropWatchPointAndUnlock would see o's watchpoint, and not change p's property. */
40 p.unwatch(0);
42 /* DropWatchPointAndUnlock would fix o's property, but not p's; p's setter would be gone. */
43 o.unwatch(0);
45 /* This would fail to invoke the arguments object's setter. */
46 p[0] = 4;
48 /* And the formal parameter would not get updated. */
49 assertEq(flag, 4);
50 }
51 }
53 f(true);
54 f(false);
56 reportCompare(true, true);