Bug 1061600 - Fix PropertyWriteNeedsTypeBarrier. r=jandem, a=abillings
authorBrian Hackett <bhackett1024@gmail.com>
Tue, 16 Sep 2014 09:03:07 -0700
changeset 216762 025117f71163
parent 216761 bd8bbb683257
child 216763 262de5944a01
push id3905
push userryanvm@gmail.com
push date2014-09-17 14:39 +0000
treeherdermozilla-beta@262de5944a01 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem, abillings
bugs1061600
milestone33.0
Bug 1061600 - Fix PropertyWriteNeedsTypeBarrier. r=jandem, a=abillings
js/src/jit/MIR.cpp
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -3705,17 +3705,17 @@ jit::PropertyWriteNeedsTypeBarrier(TempA
     bool success = true;
     for (size_t i = 0; i < types->getObjectCount(); i++) {
         types::TypeObjectKey *object = types->getObject(i);
         if (!object || object->unknownProperties())
             continue;
 
         // TI doesn't track TypedArray objects and should never insert a type
         // barrier for them.
-        if (IsTypedArrayClass(object->clasp()))
+        if (!name && IsTypedArrayClass(object->clasp()))
             continue;
 
         jsid id = name ? NameToId(name) : JSID_VOID;
         types::HeapTypeSetKey property = object->property(id);
         if (!TypeSetIncludes(property.maybeTypes(), (*pvalue)->type(), (*pvalue)->resultTypeSet())) {
             // Either pobj or pvalue needs to be modified to filter out the
             // types which the value could have but are not in the property,
             // or a VM call is required. A VM call is always required if pobj
@@ -3737,17 +3737,17 @@ jit::PropertyWriteNeedsTypeBarrier(TempA
     if (types->getObjectCount() <= 1)
         return true;
 
     types::TypeObjectKey *excluded = nullptr;
     for (size_t i = 0; i < types->getObjectCount(); i++) {
         types::TypeObjectKey *object = types->getObject(i);
         if (!object || object->unknownProperties())
             continue;
-        if (IsTypedArrayClass(object->clasp()))
+        if (!name && IsTypedArrayClass(object->clasp()))
             continue;
 
         jsid id = name ? NameToId(name) : JSID_VOID;
         types::HeapTypeSetKey property = object->property(id);
         if (TypeSetIncludes(property.maybeTypes(), (*pvalue)->type(), (*pvalue)->resultTypeSet()))
             continue;
 
         if ((property.maybeTypes() && !property.maybeTypes()->empty()) || excluded)