Bug 1075638 - GuardShape should expect template objects from CreateThisWithTemplate. r=jandem
authorNicolas B. Pierron <nicolas.b.pierron@mozilla.com>
Fri, 03 Oct 2014 14:33:08 +0200
changeset 208690 93909a51e5edeed38968cc6c06c3af178b8d4742
parent 208689 418296d647693fa0bd1802e39f22c596f41f4a4f
child 208691 795d9067f6c6157f694f7da55ac8bb93bdd86be3
push id27590
push userryanvm@gmail.com
push dateFri, 03 Oct 2014 20:06:45 +0000
treeherdermozilla-central@2f69737e5b1c [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1075638
milestone35.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1075638 - GuardShape should expect template objects from CreateThisWithTemplate. r=jandem
js/src/jit/ScalarReplacement.cpp
--- a/js/src/jit/ScalarReplacement.cpp
+++ b/js/src/jit/ScalarReplacement.cpp
@@ -134,16 +134,22 @@ EmulateStateOf<MemoryView>::run(MemoryVi
 // For the moment, this code is dumb as it only supports objects which are not
 // changing shape, and which are known by TI at the object creation.
 static bool
 IsObjectEscaped(MInstruction *ins)
 {
     MOZ_ASSERT(ins->type() == MIRType_Object);
     MOZ_ASSERT(ins->isNewObject() || ins->isGuardShape() || ins->isCreateThisWithTemplate());
 
+    JSObject *obj = nullptr;
+    if (ins->isNewObject())
+        obj = ins->toNewObject()->templateObject();
+    else if (ins->isCreateThisWithTemplate())
+        obj = ins->toCreateThisWithTemplate()->templateObject();
+
     // Check if the object is escaped. If the object is not the first argument
     // of either a known Store / Load, then we consider it as escaped. This is a
     // cheap and conservative escape analysis.
     for (MUseIterator i(ins->usesBegin()); i != ins->usesEnd(); i++) {
         MNode *consumer = (*i)->consumer();
         if (!consumer->isDefinition()) {
             // Cannot optimize if it is observable from fun.arguments or others.
             if (!consumer->toResumePoint()->isRecoverableOperand(*i)) {
@@ -179,17 +185,17 @@ IsObjectEscaped(MInstruction *ins)
             }
 #endif
             break;
           }
 
           case MDefinition::Op_GuardShape: {
             MGuardShape *guard = def->toGuardShape();
             MOZ_ASSERT(!ins->isGuardShape());
-            if (ins->toNewObject()->templateObject()->lastProperty() != guard->shape()) {
+            if (obj->lastProperty() != guard->shape()) {
                 JitSpewDef(JitSpew_Escape, "Object ", ins);
                 JitSpewDef(JitSpew_Escape, "  has a non-matching guard shape\n", guard);
                 return true;
             }
             if (IsObjectEscaped(def->toInstruction()))
                 return true;
             break;
           }