Check for inDictionaryMode after putProperty call when adding, in case of toDictionaryMode (596128, r=bhackett, a=me).
authorBrendan Eich <brendan@mozilla.org>
Wed, 15 Sep 2010 01:46:43 -0700
changeset 53889 6dfa6a7c94e04fb7da5d918ce3e4bac32c779bac
parent 53888 1128341272e698e29a234330241820524ccff3c9
child 53890 729107825a4803abe6ad7ce9a49a31e1edf3adc6
push id15730
push userbrendan@mozilla.com
push dateWed, 15 Sep 2010 08:46:52 +0000
treeherdermozilla-central@6dfa6a7c94e0 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett, me
bugs596128
milestone2.0b7pre
first release with
nightly win64
6dfa6a7c94e0 / 4.0b7pre / 20100915014851 / files
nightly linux32
nightly linux64
nightly mac
nightly win32
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
releases
nightly win64
Check for inDictionaryMode after putProperty call when adding, in case of toDictionaryMode (596128, r=bhackett, a=me).
js/src/methodjit/PolyIC.cpp
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -642,16 +642,24 @@ class SetPropCompiler : public PICStubCo
 
             const Shape *shape =
                 obj->putProperty(f.cx, id, getter, clasp->setProperty,
                                  SHAPE_INVALID_SLOT, JSPROP_ENUMERATE, flags, 0);
 
             if (!shape)
                 return false;
 
+            /*
+             * Test after calling putProperty since it can switch obj into
+             * dictionary mode, specifically if the shape tree ancestor line
+             * exceeds PropertyTree::MAX_HEIGHT.
+             */
+            if (obj->inDictionaryMode())
+                return disable("dictionary");
+
             if (!shape->hasDefaultSetter())
                 return disable("adding non-default setter");
             if (!shape->hasSlot())
                 return disable("adding invalid slot");
 
             /*
              * Watch for cases where the object reallocated its slots when
              * adding the property, and disable the PIC.  Otherwise we will