Bug 1500920 - Correct branchIfPretenuredGroup r=jandem
authorMatthew Gaudet <mgaudet@mozilla.com>
Wed, 24 Oct 2018 14:32:57 +0000
changeset 442793 486615f18dd75bebea50fbbb1154b67d8b915426
parent 442792 a90b3d91f1a442866f0cae3a350701f48056c895
child 442794 1a0b7f5e0282052c0bd67a98143cdcd2c4cb39fa
push id71645
push usermgaudet@mozilla.com
push dateWed, 24 Oct 2018 14:35:47 +0000
treeherderautoland@486615f18dd7 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1500920
milestone65.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1500920 - Correct branchIfPretenuredGroup r=jandem Depends on D9388 Differential Revision: https://phabricator.services.mozilla.com/D9605
js/src/jit/MacroAssembler.cpp
--- a/js/src/jit/MacroAssembler.cpp
+++ b/js/src/jit/MacroAssembler.cpp
@@ -3408,18 +3408,25 @@ MacroAssembler::branchIfPretenuredGroup(
 {
     movePtr(ImmGCPtr(group), scratch);
     branchIfPretenuredGroup(scratch, label);
 }
 
 void
 MacroAssembler::branchIfPretenuredGroup(Register group, Label* label)
 {
+    // To check for the pretenured flag we need OBJECT_FLAG_PRETENURED set, and
+    // OBJECT_FLAG_UNKNOWN_PROPERTIES unset, so check the latter first, and don't
+    // branch if it set.
+    Label unknownProperties;
+    branchTest32(Assembler::NonZero, Address(group, ObjectGroup::offsetOfFlags()),
+                Imm32(OBJECT_FLAG_UNKNOWN_PROPERTIES), &unknownProperties);
     branchTest32(Assembler::NonZero, Address(group, ObjectGroup::offsetOfFlags()),
                  Imm32(OBJECT_FLAG_PRE_TENURE), label);
+    bind(&unknownProperties);
 }
 
 
 void
 MacroAssembler::branchIfNonNativeObj(Register obj, Register scratch, Label* label)
 {
     loadObjClassUnsafe(obj, scratch);
     branchTest32(Assembler::NonZero, Address(scratch, Class::offsetOfFlags()),