Bug 835496 - Don't try to fix the types for object initializers with dense elements, r=jandem.
authorBrian Hackett <bhackett1024@gmail.com>
Tue, 29 Jan 2013 07:03:38 -0700
changeset 120217 42a89eaa94e03377ab01f68e0ff0d00266d9aee7
parent 120216 2b9a689ac459a8a977433b35f6cb178299372bb8
child 120218 580dbef53b91481b435aa330a419ca842c16e0cc
push id24243
push userryanvm@gmail.com
push dateWed, 30 Jan 2013 00:49:21 +0000
treeherdermozilla-central@5c248ef0fe62 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs835496
milestone21.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 835496 - Don't try to fix the types for object initializers with dense elements, r=jandem.
js/src/jit-test/tests/ion/bug835496.js
js/src/jsinfer.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug835496.js
@@ -0,0 +1,6 @@
+// |jit-test| error: TypeError
+
+(function([{x}]) {})({
+    t: 0,
+    "1": 0
+})
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -3243,17 +3243,17 @@ TypeCompartment::fixObjectType(JSContext
     /*
      * Use the same type object for all singleton/JSON arrays with the same
      * base shape, i.e. the same fields written in the same order. If there
      * is a type mismatch with previous objects of the same shape, use the
      * generic unknown type.
      */
     JS_ASSERT(obj->isObject());
 
-    if (obj->slotSpan() == 0 || obj->inDictionaryMode())
+    if (obj->slotSpan() == 0 || obj->inDictionaryMode() || !obj->hasEmptyElements())
         return;
 
     ObjectTypeTable::AddPtr p = objectTypeTable->lookupForAdd(obj.get());
     Shape *baseShape = obj->lastProperty();
 
     if (p) {
         /* The lookup ensures the shape matches, now check that the types match. */
         Type *types = p->value.types;