Bug 1255316 - IonMonkey: Also take into account the offsetAdjustment when folding MLoadUnboxedObjectOrNull, r=jandem
authorHannes Verschore <hv1989@gmail.com>
Wed, 23 Mar 2016 05:25:21 -0400
changeset 290009 d2eaee9d7294951ec34609f41a3156164a6b4e04
parent 290008 d07c014f69c1a1fab4f5dfa344e11942dfe417a5
child 290010 af3a5793ae397f0e719dafe468350c4c843e7621
push id30112
push usercbook@mozilla.com
push dateWed, 23 Mar 2016 15:25:32 +0000
treeherdermozilla-central@6202ade0e6d6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1255316
milestone48.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1255316 - IonMonkey: Also take into account the offsetAdjustment when folding MLoadUnboxedObjectOrNull, r=jandem
js/src/jit/MIR.cpp
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -4739,17 +4739,19 @@ MLoadUnboxedObjectOrNull::foldsTo(TempAl
         return this;
 
     if (store->index() != index())
         return this;
 
     if (store->value()->type() == MIRType_ObjectOrNull)
         return this;
 
-    MOZ_ASSERT(offsetAdjustment() == store->offsetAdjustment());
+    if (store->offsetAdjustment() != offsetAdjustment())
+        return this;
+
     return foldsToStoredValue(alloc, store->value());
 }
 
 // Gets the MDefinition* representing the source/target object's storage.
 // Usually this is just an MElements*, but sometimes there are layers
 // of indirection or inlining, which are handled elsewhere.
 static inline const MElements*
 MaybeUnwrapElements(const MDefinition* elementsOrObj)