Bug 993058 - Loosen aliasing assertion in LIRGenerator::visitGetDOMMember. r=bz.
authorPeter Van der Beken <peterv@propagandism.org>
Tue, 25 Mar 2014 19:17:46 +0100
changeset 177576 b6a353fc2b947c67192e2ac6535a9b99da33c1ec
parent 177575 f6b0e518f6d2200de210c8fb7da267ca7f4db6f9
child 177577 8920c42b19309e22a71db54ae5992c19386248f2
push id26556
push userryanvm@gmail.com
push dateTue, 08 Apr 2014 22:16:57 +0000
treeherdermozilla-central@5811efc11011 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbz
bugs993058
milestone31.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 993058 - Loosen aliasing assertion in LIRGenerator::visitGetDOMMember. r=bz.
js/src/jit/Lowering.cpp
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -3527,18 +3527,21 @@ LIRGenerator::visitGetDOMProperty(MGetDO
 
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
 bool
 LIRGenerator::visitGetDOMMember(MGetDOMMember *ins)
 {
     MOZ_ASSERT(ins->isDomMovable(), "Members had better be movable");
-    MOZ_ASSERT(ins->domAliasSet() == JSJitInfo::AliasNone,
-               "Members had better not alias anything");
+    // We wish we could assert that ins->domAliasSet() == JSJitInfo::AliasNone,
+    // but some MGetDOMMembers are for [Pure], not [Constant] properties, whose
+    // value can in fact change as a result of DOM setters and method calls.
+    MOZ_ASSERT(ins->domAliasSet() != JSJitInfo::AliasEverything,
+               "Member gets had better not alias the world");
     LGetDOMMember *lir =
         new(alloc()) LGetDOMMember(useRegister(ins->object()));
     return defineBox(lir, ins);
 }
 
 bool
 LIRGenerator::visitRecompileCheck(MRecompileCheck *ins)
 {