Merge.
authorDavid Anderson <danderson@mozilla.com>
Thu, 28 Jun 2012 12:16:09 -0700
changeset 106481 81bbe0cb3ab47f6341b186fb64ba52da0954bf6f
parent 106480 f839b591b5928f010faa6094a002d53c6430a96a (current diff)
parent 106479 4f57f42dc238d1c724666da7cf447dfabf383834 (diff)
child 106482 3112408514c8f0eb85637e880cf6665e5512c1ad
push id23447
push userdanderson@mozilla.com
push dateTue, 11 Sep 2012 17:34:27 +0000
treeherdermozilla-central@fdfaef738a00 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone16.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Merge.
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -4625,17 +4625,16 @@ IonBuilder::jsop_not()
 
 
 inline bool
 IonBuilder::TestCommonPropFunc(JSContext *cx, types::TypeSet *types, HandleId id,
                    JSFunction **funcp, bool isGetter)
 {
     JSObject *found = NULL;
     JSObject *foundProto = NULL;
-    Shape *protoShape = NULL;
 
     *funcp = NULL;
 
     // No sense looking if we don't know what's going on.
     if (!types || types->unknownObject())
         return true;
 
     // Iterate down all the types to see if they all have the same getter or
@@ -4702,34 +4701,33 @@ IonBuilder::TestCommonPropFunc(JSContext
         if (!found)
             found = curFound;
         else if (found != curFound)
             return true;
 
         // We only support cases with a single prototype shared. This is
         // overwhelmingly more likely than having multiple different prototype
         // chains with the same custom property function.
-        if (!foundProto) {
+        if (!foundProto)
             foundProto = proto;
-            protoShape = shape;
-        } else if (foundProto != proto)
+        else if (foundProto != proto)
             return true;
     }
 
     // No need to add a freeze if we didn't find anything
     if (!found)
         return true;
 
-    JS_ASSERT(foundProto && protoShape);
+    JS_ASSERT(foundProto);
 
     types->addFreeze(cx);
 
     MInstruction *wrapper = MConstant::New(ObjectValue(*foundProto));
     current->add(wrapper);
-    MGuardShape *guard = MGuardShape::New(wrapper, protoShape);
+    MGuardShape *guard = MGuardShape::New(wrapper, foundProto->lastProperty());
     current->add(guard);
 
     // Now we have to freeze all the property typesets to ensure there isn't a
     // lower shadowing getter or setter installed in the future.
     types::TypeObject *curType;
     for (unsigned i = 0; i < types->getObjectCount(); i++) {
         curType = types->getTypeObject(i);