Bug 918526 - Fix an exact rooting hazard in IonCache; r=nbp
authorTerrence Cole <terrence@mozilla.com>
Thu, 19 Sep 2013 14:48:11 -0700
changeset 162312 00ee597a7cdc6fc01137b141ef0ce6f33936258c
parent 162311 9b543adac3cd7980978942a67c0a7d9002d28231
child 162313 7ec69b142816744544fb7e792b4ce6bb0e11d9a2
push id3066
push userakeybl@mozilla.com
push dateMon, 09 Dec 2013 19:58:46 +0000
treeherdermozilla-beta@a31a0dce83aa [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnbp
bugs918526
milestone27.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 918526 - Fix an exact rooting hazard in IonCache; r=nbp
js/src/jit/IonCaches.cpp
--- a/js/src/jit/IonCaches.cpp
+++ b/js/src/jit/IonCaches.cpp
@@ -2590,28 +2590,28 @@ SetPropertyIC::attachNativeAdding(JSCont
 
 static bool
 IsPropertySetInlineable(JSContext *cx, const SetPropertyIC &cache, HandleObject obj,
                         HandleId id, MutableHandleShape pshape, bool *checkTypeset)
 {
     if (!obj->isNative())
         return false;
 
-    Shape *shape = obj->nativeLookup(cx, id);
-
-    if (!shape)
+    pshape.set(obj->nativeLookup(cx, id));
+
+    if (!pshape)
         return false;
 
-    if (!shape->hasSlot())
+    if (!pshape->hasSlot())
         return false;
 
-    if (!shape->hasDefaultSetter())
+    if (!pshape->hasDefaultSetter())
         return false;
 
-    if (!shape->writable())
+    if (!pshape->writable())
         return false;
 
     bool shouldCheck = false;
     types::TypeObject *type = obj->getType(cx);
     if (cache.needsTypeBarrier() && !type->unknownProperties()) {
         RootedId typeId(cx, types::IdToTypeId(id));
         types::HeapTypeSet *propTypes = type->maybeGetProperty(cx, typeId);
         if (!propTypes)
@@ -2635,17 +2635,16 @@ IsPropertySetInlineable(JSContext *cx, c
                     if (!propTypes->hasType(types::Type::PrimitiveType(valType)))
                         return false;
                     shouldCheck = false;
                 }
             }
         }
     }
 
-    pshape.set(shape);
     *checkTypeset = shouldCheck;
 
     return true;
 }
 
 static bool
 IsPropertyAddInlineable(JSContext *cx, HandleObject obj, HandleId id, uint32_t oldSlots,
                         MutableHandleShape pShape)