Bug 789735 - Handle lazily-created TypeObjects in IonBuilder. r=dvander
authorSean Stangl <sstangl@mozilla.com>
Mon, 10 Sep 2012 15:13:38 -0700
changeset 106704 c60d8106fd071946f7c499cee7a7ab8416601ed2
parent 106703 9425b626563a19d5ee8b3e37e13cc09e1bcd27f8
child 106705 0cfbab29496e1993b5fa5744c347fcc78774e162
push id1327
push usersean.stangl@gmail.com
push dateMon, 10 Sep 2012 22:17:33 +0000
reviewersdvander
bugs789735
milestone18.0a1
Bug 789735 - Handle lazily-created TypeObjects in IonBuilder. r=dvander
js/src/ion/IonBuilder.cpp
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -5606,20 +5606,20 @@ IonBuilder::annotateGetPropertyCache(JSC
         if (ownTypes->isOwnProperty(cx, typeObj, false))
             continue;
 
         bool knownConstant = false;
         Rooted<JSObject*> proto(cx, typeObj->proto);
         if (!TestSingletonProperty(cx, proto, id, &knownConstant))
             return false;
 
-        if (!knownConstant || proto->type()->unknownProperties())
+        if (!knownConstant || proto->getType(cx)->unknownProperties())
             continue;
 
-        types::HeapTypeSet *protoTypes = proto->type()->getProperty(cx, id, false);
+        types::HeapTypeSet *protoTypes = proto->getType(cx)->getProperty(cx, id, false);
         if (!protoTypes)
             continue;
 
         JSObject *obj = protoTypes->getSingleton(cx);
         if (!obj || !obj->isFunction())
             continue;
 
         // Don't add cases corresponding to non-observed pushes