Always generate new shapes when setting uncacheable flags after prototype changes, don't cache native iterators for objects with uncacheable prototypes, bug 705895.

2011-11-28 17:27:00 -08:00
parent 07340b8ae4
commit 51b57b8cf2
5 changed files with 31 additions and 6 deletions
--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -622,6 +622,7 @@ GetIterator(JSContext *cx, JSObject *obj, uintN flags, Value *vp)
            JSObject *pobj = obj;
            do {
                if (!pobj->isNative() ||
+                    pobj->hasUncacheableProto() ||
                    obj->getOps()->enumerate ||
                    pobj->getClass()->enumerate != JS_EnumerateStub) {
                    shapes.clear();