Bug 1182060 - IsObjectEscaped: Handle UnboxedPlainObject in guard shape. r=bhackett
authorNicolas B. Pierron <nicolas.b.pierron@mozilla.com>
Wed, 15 Jul 2015 20:40:03 +0200
changeset 253086 c0afcf6ed3244f4b516b722c20b054807322536e
parent 253085 eca18bb1b558d77259ecf4d41e4354fb8bada232
child 253087 a9787cd39303b0f2197322e11cbb1c89b2f500d8
push id29061
push userryanvm@gmail.com
push dateThu, 16 Jul 2015 18:53:45 +0000
treeherdermozilla-central@a0f4a688433d [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett
bugs1182060
milestone42.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1182060 - IsObjectEscaped: Handle UnboxedPlainObject in guard shape. r=bhackett
js/src/jit/ScalarReplacement.cpp
--- a/js/src/jit/ScalarReplacement.cpp
+++ b/js/src/jit/ScalarReplacement.cpp
@@ -215,17 +215,17 @@ IsObjectEscaped(MInstruction* ins, JSObj
             }
 #endif
             break;
           }
 
           case MDefinition::Op_GuardShape: {
             MGuardShape* guard = def->toGuardShape();
             MOZ_ASSERT(!ins->isGuardShape());
-            if (obj->as<NativeObject>().lastProperty() != guard->shape()) {
+            if (obj->maybeShape() != guard->shape()) {
                 JitSpewDef(JitSpew_Escape, "has a non-matching guard shape\n", guard);
                 return true;
             }
             if (IsObjectEscaped(def->toInstruction(), obj)) {
                 JitSpewDef(JitSpew_Escape, "is indirectly escaped by\n", def);
                 return true;
             }
             break;