Fix recompilation hazard in CALLELEMENT,
bug 686107. r=dvander a=asa
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -2874,29 +2874,31 @@ ic::CallElement(VMFrame &f, ic::GetEleme
// Right now, we don't optimize for strings.
if (!f.regs.sp[-2].isObject()) {
ic->disable(cx, "non-object");
stubs::CallElem(f);
return;
}
+ RecompilationMonitor monitor(cx);
+
Value thisv = f.regs.sp[-2];
JSObject *thisObj = ValuePropertyBearer(cx, thisv, -2);
if (!thisObj)
THROW();
jsid id;
Value idval = f.regs.sp[-1];
if (idval.isInt32() && INT_FITS_IN_JSID(idval.toInt32()))
id = INT_TO_JSID(idval.toInt32());
else if (!js_InternNonIntElementId(cx, thisObj, idval, &id))
THROW();
- if (ic->shouldUpdate(cx)) {
+ if (!monitor.recompiled() && ic->shouldUpdate(cx)) {
#ifdef DEBUG
f.regs.sp[-2] = MagicValue(JS_GENERIC_MAGIC);
#endif
LookupStatus status = ic->update(f, cx, thisObj, idval, id, &f.regs.sp[-2]);
if (status != Lookup_Uncacheable) {
if (status == Lookup_Error)
THROW();