Bug 868890 - Correctly generate barrier when accessing undefined properties of objects whose prototype also has the property, r=dvander.
authorBrian Hackett <bhackett1024@gmail.com>
Wed, 08 May 2013 17:25:24 -0600
changeset 138090 b262e6be083309762433eee44bdc7d67c37c20b6
parent 138089 6e52ff141274ceadc96a6a74414f1c5c70609fa1
child 138091 f6b920f5e96c048539e2fcbab44a22079b339dd5
push id3752
push userlsblakk@mozilla.com
push dateMon, 13 May 2013 17:21:10 +0000
treeherdermozilla-aurora@1580544aef0b [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdvander
bugs868890
milestone23.0a1
Bug 868890 - Correctly generate barrier when accessing undefined properties of objects whose prototype also has the property, r=dvander.
js/src/ion/MIR.cpp
--- a/js/src/ion/MIR.cpp
+++ b/js/src/ion/MIR.cpp
@@ -2415,23 +2415,26 @@ ion::PropertyReadNeedsTypeBarrier(JSCont
     // for a property do not, however, reflect inherited types until a
     // getFromPrototypes() call has been performed.
     if (!property->hasPropagatedProperty())
         object->getFromPrototypes(cx, id, property);
 
     if (!TypeSetIncludes(observed, MIRType_Value, property))
         return true;
 
-    // Type information for global objects does not reflect the initial
-    // 'undefined' value of variables declared with 'var'. Until the variable
-    // is assigned a value other than undefined, a barrier is required.
-    if (property->empty() && name && object->singleton && object->singleton->isNative()) {
+    // Type information for singleton objects is not required to reflect the
+    // initial 'undefined' value for native properties, in particular global
+    // variables declared with 'var'. Until the property is assigned a value
+    // other than undefined, a barrier is required.
+    if (name && object->singleton && object->singleton->isNative()) {
         Shape *shape = object->singleton->nativeLookup(cx, name);
-        if (shape && shape->hasDefaultGetter()) {
-            JS_ASSERT(object->singleton->nativeGetSlot(shape->slot()).isUndefined());
+        if (shape &&
+            shape->hasDefaultGetter() &&
+            object->singleton->nativeGetSlot(shape->slot()).isUndefined())
+        {
             return true;
         }
     }
 
     property->addFreeze(cx);
     return false;
 }