Fixed a bug where no shape guard was emitted if a property was not found, causing it to remain unseen if added later. Abort in this case instead. (bug 457171, r=brendan)
authorDavid Anderson <danderson@mozilla.com>
Fri, 26 Sep 2008 19:18:00 -0700
changeset 19994 af4d2ab298e07b9f66bc8566308c799d904fc37e
parent 19993 cfa7088079dadada0940c005d2b1b761304df089
child 19996 de17fecafd161469bbb7bb904d003c82cc5b433f
push id2577
push userbrendan@mozilla.com
push dateWed, 01 Oct 2008 04:35:27 +0000
treeherdermozilla-central@a613924403d6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbrendan
bugs457171
milestone1.9.1b1pre
Fixed a bug where no shape guard was emitted if a property was not found, causing it to remain unseen if added later. Abort in this case instead. (bug 457171, r=brendan)
js/src/jstracer.cpp
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -3551,17 +3551,17 @@ TraceRecorder::test_property_cache(JSObj
         if (!prop) {
             // Propagate obj from js_FindPropertyHelper to record_JSOP_BINDNAME
             // via our obj2 out-parameter. If we are recording JSOP_SETNAME and
             // the global it's assigning does not yet exist, create it.
             obj2 = obj;
 
             // Use PCVAL_NULL to return "no such property" to our caller.
             pcval = PCVAL_NULL;
-            return true;
+            ABORT_TRACE("failed to find property");
         }
 
         OBJ_DROP_PROPERTY(cx, obj2, prop);
         if (!entry)
             ABORT_TRACE("failed to fill property cache");
     }
 
 #ifdef JS_THREADSAFE