Bug 1328834 - Check hasScript in IonBuilder::createThisScriptedSingleton. r=h4writer, a=jcristau
authorJan de Mooij <jdemooij@mozilla.com>
Tue, 10 Jan 2017 11:52:59 +0100
changeset 350131 142e00af396681004d8c9ed9e203617b6847ee7c
parent 350130 fbf2489167ea57ee84f5f0d0881b4e839a354191
child 350132 e7bab2d3d88a528f846123202b338976091f7d3c
push id10555
push userryanvm@gmail.com
push dateTue, 10 Jan 2017 19:09:36 +0000
treeherdermozilla-aurora@838e1c92ded6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersh4writer, jcristau
bugs1328834
milestone52.0a2
Bug 1328834 - Check hasScript in IonBuilder::createThisScriptedSingleton. r=h4writer, a=jcristau
js/src/jit/IonBuilder.cpp
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -6345,16 +6345,19 @@ IonBuilder::getSingletonPrototype(JSFunc
     HeapTypeSetKey protoProperty = targetKey->property(protoid);
 
     return protoProperty.singleton(constraints());
 }
 
 MDefinition*
 IonBuilder::createThisScriptedSingleton(JSFunction* target, MDefinition* callee)
 {
+    if (!target->hasScript())
+        return nullptr;
+
     // Get the singleton prototype (if exists)
     JSObject* proto = getSingletonPrototype(target);
     if (!proto)
         return nullptr;
 
     JSObject* templateObject = inspector->getTemplateObject(pc);
     if (!templateObject)
         return nullptr;