Bug 1236519 - Ensure JSFunction::isDerivedClassConstructor properly handles lazy self-hosted functions. r=till a=bustage
authorEric Faust <efaustbmo@gmail.com>
Wed, 13 Jan 2016 10:33:38 -0800
changeset 279740 ad1f85f172b7302bef0fa9780df8e2b962780ac6
parent 279739 531d1f6d1cde1182e9f7f9dff81a4fc5abc0a601
child 279761 c970bca8297d3a6e348c539b8cb9aa68e19087be
push id29886
push userkwierso@gmail.com
push dateWed, 13 Jan 2016 18:34:25 +0000
treeherdermozilla-central@ad1f85f172b7 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerstill, bustage
bugs1236519
milestone46.0a1
first release with
nightly linux32
ad1f85f172b7 / 46.0a1 / 20160113140000 / files
nightly linux64
ad1f85f172b7 / 46.0a1 / 20160113140011 / files
nightly mac
ad1f85f172b7 / 46.0a1 / 20160113135947 / files
nightly win32
ad1f85f172b7 / 46.0a1 / 20160113141333 / files
nightly win64
ad1f85f172b7 / 46.0a1 / 20160113140035 / files
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
releases
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1236519 - Ensure JSFunction::isDerivedClassConstructor properly handles lazy self-hosted functions. r=till a=bustage
js/src/jsfun.cpp
js/src/jsfun.h
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -1290,16 +1290,40 @@ JSFunction::infallibleIsDefaultClassCons
     }
 
     MOZ_ASSERT_IF(isDefault, isConstructor());
     MOZ_ASSERT_IF(isDefault, isClassConstructor());
     return isDefault;
 }
 
 bool
+JSFunction::isDerivedClassConstructor()
+{
+    bool derived;
+    if (isInterpretedLazy()) {
+        // There is only one plausible lazy self-hosted derived
+        // constructor.
+        if (isSelfHostedBuiltin()) {
+            JSAtom* name = &getExtendedSlot(LAZY_FUNCTION_NAME_SLOT).toString()->asAtom();
+
+            // This function is called from places without access to a
+            // JSContext. Trace some plumbing to get what we want.
+            derived = name == compartment()->runtimeFromAnyThread()->
+                              commonNames->DefaultDerivedClassConstructor;
+        } else {
+            derived = lazyScript()->isDerivedClassConstructor();
+        }
+    } else {
+        derived = nonLazyScript()->isDerivedClassConstructor();
+    }
+    MOZ_ASSERT_IF(derived, isClassConstructor());
+    return derived;
+}
+
+bool
 JSFunction::getLength(JSContext* cx, uint16_t* length)
 {
     JS::RootedFunction self(cx, this);
     MOZ_ASSERT(!self->isBoundFunction());
     if (self->isInterpretedLazy() && !self->getOrCreateScript(cx))
         return false;
 
     *length = self->hasScript() ? self->nonLazyScript()->funLength()
--- a/js/src/jsfun.h
+++ b/js/src/jsfun.h
@@ -533,25 +533,17 @@ class JSFunction : public js::NativeObje
         return u.n.jitinfo;
     }
 
     void setJitInfo(const JSJitInfo* data) {
         MOZ_ASSERT(isNative());
         u.n.jitinfo = data;
     }
 
-    bool isDerivedClassConstructor() {
-        bool derived;
-        if (isInterpretedLazy())
-            derived = lazyScript()->isDerivedClassConstructor();
-        else
-            derived = nonLazyScript()->isDerivedClassConstructor();
-        MOZ_ASSERT_IF(derived, isClassConstructor());
-        return derived;
-    }
+    bool isDerivedClassConstructor();
 
     static unsigned offsetOfNativeOrScript() {
         static_assert(offsetof(U, n.native) == offsetof(U, i.s.script_),
                       "native and script pointers must be in the same spot "
                       "for offsetOfNativeOrScript() have any sense");
         static_assert(offsetof(U, n.native) == offsetof(U, nativeOrScript),
                       "U::nativeOrScript must be at the same offset as "
                       "native");