Bug 879723 - Make sure property types reflect inherited types from the prototype when specializing a setgname. (r=bhackett)
authorShu-yu Guo <shu@rfrn.org>
Mon, 10 Jun 2013 12:10:13 -0700
changeset 134547 7ecbdd6586376c8a159a1119f328aed508dba684
parent 134546 b6652771e70fdd26ef094381aaffb1af1ae3de6f
child 134548 6053305ba2b37afa331e66b7d8aa25d03de6cd5d
push id29264
push usershu@rfrn.org
push dateMon, 10 Jun 2013 19:11:11 +0000
treeherdermozilla-inbound@7ecbdd658637 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett
bugs879723
milestone24.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 879723 - Make sure property types reflect inherited types from the prototype when specializing a setgname. (r=bhackett)
js/src/ion/IonBuilder.cpp
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -6086,18 +6086,25 @@ IonBuilder::setStaticName(HandleObject s
     // Slots in the global object will be treated as roots during a minor GC.
     if (!staticObject->isGlobal() && NeedsPostBarrier(info(), value))
         current->add(MPostWriteBarrier::New(obj, value));
 
     // If the property has a known type, we may be able to optimize typed stores by not
     // storing the type tag. This only works if the property does not have its initial
     // |undefined| value; if |undefined| is assigned at a later point, it will be added
     // to the type set.
+    //
+    // We also need to make sure the typeset reflects the inherited types from
+    // the prototype by calling getFromPrototype. Otherwise we may specialize
+    // on a typeset that changes before compilation ends, which would mean the
+    // current script wouldn't be recompiled even when our assumption here is
+    // made false.
     MIRType slotType = MIRType_None;
     if (propertyTypes && !staticObject->getSlot(shape->slot()).isUndefined()) {
+        staticType->getFromPrototypes(cx, id, propertyTypes);
         JSValueType knownType = propertyTypes->getKnownTypeTag(cx);
         if (knownType != JSVAL_TYPE_UNKNOWN)
             slotType = MIRTypeFromValueType(knownType);
     }
 
     bool needsBarrier = !propertyTypes || propertyTypes->needsBarrier(cx);
     return storeSlot(obj, shape, value, needsBarrier, slotType);
 }