Bug 1006811: IonMonkey: Don't inline bound function if target is not a function, r=jandem
authorHannes Verschore <hv1989@gmail.com>
Fri, 16 May 2014 23:47:04 +0200
changeset 183635 7dabcbd22f0943f0d40705d644bc2c1577ec7429
parent 183634 a1a599888834c784e2db167d9d5aec852862aefe
child 183636 0a33647d1dc0b65bff6eccf8d4c43a36cb8084f6
push id6844
push userphilringnalda@gmail.com
push dateSun, 18 May 2014 01:12:08 +0000
treeherderfx-team@41a54c8add09 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1006811
milestone32.0a1
Bug 1006811: IonMonkey: Don't inline bound function if target is not a function, r=jandem
js/src/jit/MCallOptimize.cpp
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -1910,16 +1910,19 @@ IonBuilder::inlineAssertFloat32(CallInfo
     current->add(undefined);
     current->push(undefined);
     return InliningStatus_Inlined;
 }
 
 IonBuilder::InliningStatus
 IonBuilder::inlineBoundFunction(CallInfo &nativeCallInfo, JSFunction *target)
 {
+     if (!target->getBoundFunctionTarget()->is<JSFunction>())
+         return InliningStatus_NotInlined;
+
     JSFunction *scriptedTarget = &(target->getBoundFunctionTarget()->as<JSFunction>());
     JSRuntime *runtime = scriptedTarget->runtimeFromMainThread();
 
     // Don't optimize if we're constructing and the callee is not a
     // constructor, so that CallKnown does not have to handle this case
     // (it should always throw).
     if (nativeCallInfo.constructing() && !scriptedTarget->isInterpretedConstructor() &&
         !scriptedTarget->isNativeConstructor())