author | Jan de Mooij <jdemooij@mozilla.com> |
Sun, 15 Dec 2019 11:32:25 +0000 | |
changeset 507021 | 307481f32d4403dae943b9ff26cd7a7e2eadf083 |
parent 507020 | 273abf200022ad239b277942149e6268c4fec8b2 |
child 507022 | 4903b1b93526423b2a52251081252fcfe100d8f5 |
push id | 36920 |
push user | dluca@mozilla.com |
push date | Sun, 15 Dec 2019 21:49:48 +0000 |
treeherder | mozilla-central@7e6a4e221495 [default view] [failures only] |
perfherder | [talos] [build metrics] [platform microbench] (compared to previous push) |
reviewers | tcampbell |
bugs | 1601599 |
milestone | 73.0a1 |
first release with | nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
|
last release without | nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
|
--- a/js/src/jit/IonBuilder.cpp +++ b/js/src/jit/IonBuilder.cpp @@ -8563,19 +8563,22 @@ AbortReasonOr<Ok> IonBuilder::setStaticN // Don't optimize global lexical bindings if they aren't initialized at // compile time. if (isGlobalLexical && IsUninitializedGlobalLexicalSlot(staticObject, name)) { return jsop_setprop(name); } current->pop(); - // Pop the bound object on the stack. + // Pop the bound object on the stack. This is usually a constant but it can + // be a phi if loops are involved, for example: x = [...arr]; MDefinition* obj = current->pop(); - MOZ_ASSERT(&obj->toConstant()->toObject() == staticObject); + MOZ_ASSERT(obj->isConstant() || obj->isPhi()); + MOZ_ASSERT_IF(obj->isConstant(), + &obj->toConstant()->toObject() == staticObject); if (needsPostBarrier(value)) { current->add(MPostWriteBarrier::New(alloc(), obj, value)); } // If the property has a known type, we may be able to optimize typed stores // by not storing the type tag. MIRType slotType = MIRType::None;