Bug 1054359 - Add is-object check to IonBuilder::makeCallHelper. r=efaust, a=1.4+
☠☠ backed out by e1e656a81884 ☠ ☠
authorJan de Mooij <jdemooij@mozilla.com>
Mon, 18 Aug 2014 12:03:55 +0200
changeset 188487 a2712ce8bf929214c8f568a8d0bf04f2377d4270
parent 188486 79a3790888d20cf1bad57d5fb323b47baeba7cfa
child 188488 e1e656a81884586974306613d2ecdefcc673cb07
push id621
push userryanvm@gmail.com
push dateMon, 18 Aug 2014 20:23:42 +0000
treeherdermozilla-b2g30_v1_4@a2712ce8bf92 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersefaust, 1
bugs1054359
milestone30.0
Bug 1054359 - Add is-object check to IonBuilder::makeCallHelper. r=efaust, a=1.4+
js/src/jit/IonBuilder.cpp
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -5209,16 +5209,17 @@ IonBuilder::makeCallHelper(JSFunction *t
 
     bool isDOMCall = false;
     if (target && !callInfo.constructing()) {
         // We know we have a single call target.  Check whether the "this" types
         // are DOM types and our function a DOM function, and if so flag the
         // MCall accordingly.
         types::TemporaryTypeSet *thisTypes = callInfo.thisArg()->resultTypeSet();
         if (thisTypes &&
+            thisTypes->getKnownMIRType() == MIRType_Object &&
             thisTypes->isDOMClass() &&
             testShouldDOMCall(thisTypes, target, JSJitInfo::Method))
         {
             isDOMCall = true;
         }
     }
 
     MCall *call = MCall::New(alloc(), target, targetArgs + 1, callInfo.argc(),