[INFER] Fix ADDPROP PIC recompilation hazard, bug 680797.
authorBrian Hackett <bhackett1024@gmail.com>
Sun, 21 Aug 2011 20:28:38 -0700
changeset 76142 c685e6d1774517f396fe5b35646bddbf7f5815a9
parent 76141 d7217d210771b2095930bb42291d2e4bff7dea89
child 76143 8fe193e034cb542f1edf2de21e673432325449e1
push id3
push userfelipc@gmail.com
push dateFri, 30 Sep 2011 20:09:13 +0000
bugs680797
milestone9.0a1
[INFER] Fix ADDPROP PIC recompilation hazard, bug 680797.
js/src/methodjit/PolyIC.cpp
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -618,16 +618,19 @@ class SetPropCompiler : public PICStubCo
             const Shape *shape =
                 obj->putProperty(cx, id, getter, clasp->setProperty,
                                  SHAPE_INVALID_SLOT, JSPROP_ENUMERATE, flags, 0);
             if (!shape)
                 return error();
             if (flags & Shape::METHOD)
                 obj->nativeSetSlot(shape->slot, f.regs.sp[-1]);
 
+            if (monitor.recompiled())
+                return Lookup_Uncacheable;
+
             /*
              * Test after calling putProperty since it can switch obj into
              * dictionary mode, specifically if the shape tree ancestor line
              * exceeds PropertyTree::MAX_HEIGHT.
              */
             if (obj->inDictionaryMode())
                 return disable("dictionary");