Bug 1255316 - IonMonkey: Also take into account the offsetAdjustment when folding MLoadUnboxedObjectOrNull, r=jandem
authorHannes Verschore <hv1989@gmail.com>
Wed, 23 Mar 2016 05:25:21 -0400
changeset 290068 d2eaee9d7294951ec34609f41a3156164a6b4e04
parent 290067 d07c014f69c1a1fab4f5dfa344e11942dfe417a5
child 290069 af3a5793ae397f0e719dafe468350c4c843e7621
push id19656
push usergwagner@mozilla.com
push dateMon, 04 Apr 2016 13:43:23 +0000
treeherderb2g-inbound@e99061fde28a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1255316
milestone48.0a1
Bug 1255316 - IonMonkey: Also take into account the offsetAdjustment when folding MLoadUnboxedObjectOrNull, r=jandem
js/src/jit/MIR.cpp
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -4739,17 +4739,19 @@ MLoadUnboxedObjectOrNull::foldsTo(TempAl
         return this;
 
     if (store->index() != index())
         return this;
 
     if (store->value()->type() == MIRType_ObjectOrNull)
         return this;
 
-    MOZ_ASSERT(offsetAdjustment() == store->offsetAdjustment());
+    if (store->offsetAdjustment() != offsetAdjustment())
+        return this;
+
     return foldsToStoredValue(alloc, store->value());
 }
 
 // Gets the MDefinition* representing the source/target object's storage.
 // Usually this is just an MElements*, but sometimes there are layers
 // of indirection or inlining, which are handled elsewhere.
 static inline const MElements*
 MaybeUnwrapElements(const MDefinition* elementsOrObj)