Bug 1318634 - Fix AddCacheIRGetPropFunction to add the receiver after doing other checks. r=h4writer
authorJan de Mooij <jdemooij@mozilla.com>
Sat, 19 Nov 2016 11:13:04 +0100
changeset 323520 528b50a82eabb4481e6c113f922823325d8c1753
parent 323519 cc8f92af70ab9d5dc7a06e6ef26bbb3f72d46d56
child 323521 948acab0390352a0b39d72b08b65e31933cc6fd3
push id30978
push usercbook@mozilla.com
push dateMon, 21 Nov 2016 14:44:46 +0000
treeherdermozilla-central@0534254e9a40 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersh4writer
bugs1318634
milestone53.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1318634 - Fix AddCacheIRGetPropFunction to add the receiver after doing other checks. r=h4writer
js/src/jit-test/tests/ion/bug1318634.js
js/src/jit/BaselineInspector.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1318634.js
@@ -0,0 +1,20 @@
+var o1 = {get x() { return 1; }};
+var o2 = {get x() { return 2; }};
+var o3 = Object.create(o1);
+
+function f(o) {
+    return o.x;
+}
+
+var res = 0;
+for (var i=0; i<15; i++) {
+    res += f(o3);
+    res += f(o2);
+}
+
+o1.y = 1;
+
+for (var i=0; i<110; i++)
+    res += f(o2);
+
+assertEq(res, 265);
--- a/js/src/jit/BaselineInspector.cpp
+++ b/js/src/jit/BaselineInspector.cpp
@@ -811,24 +811,24 @@ AddCacheIRGetPropFunction(ICCacheIR_Moni
     JSFunction* getter =
         &stub->stubInfo()->getStubField<JSObject*>(stub, offset)->as<JSFunction>();
 
     if (*commonGetter && (*isOwnProperty || *globalShape || *holderShape != objShape))
         return false;
 
     MOZ_ASSERT_IF(*commonGetter, *commonGetter == getter);
 
-    if (!AddReceiver(receiver, receivers, convertUnboxedGroups))
-        return false;
-
     if (obj->as<NativeObject>().lastProperty() != objShape) {
         // Skip this stub as the shape is no longer correct.
         return true;
     }
 
+    if (!AddReceiver(receiver, receivers, convertUnboxedGroups))
+        return false;
+
     *holder = obj;
     *holderShape = objShape;
     *commonGetter = getter;
     *isOwnProperty = false;
     return true;
 }
 
 bool