Bug 930991 - IonMonkey: Fix bailout during arguments check with TypeSets that contain a combination of SingleObjects and TypedObjects, r=jandem
authorHannes Verschore <hv1989@gmail.com>
Fri, 25 Oct 2013 16:21:15 +0200
changeset 166069 14fa49fdadfe25e0f57f146aa387b30ff253f72c
parent 166068 c6731046b7967cc53c99f20060009d6ddfc04e90
child 166070 c15734ce49d024852afcff54edcfd00b8b0688e0
push id3066
push userakeybl@mozilla.com
push dateMon, 09 Dec 2013 19:58:46 +0000
treeherdermozilla-beta@a31a0dce83aa [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs930991
milestone27.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 930991 - IonMonkey: Fix bailout during arguments check with TypeSets that contain a combination of SingleObjects and TypedObjects, r=jandem
js/src/jit/IonMacroAssembler.cpp
--- a/js/src/jit/IonMacroAssembler.cpp
+++ b/js/src/jit/IonMacroAssembler.cpp
@@ -155,16 +155,24 @@ MacroAssembler::guardObjectType(Register
         if (lastBranch.isInitialized())
             lastBranch.emit(*this);
 
         JSObject *object = types->getSingleObject(i);
         lastBranch = BranchGCPtr(Equal, obj, ImmGCPtr(object), &matched);
     }
 
     if (hasTypeObjects) {
+        // We are possibly going to overwrite the obj register. So already
+        // emit the branch, since branch depends on previous value of obj
+        // register and there is definitely a branch following. So no need
+        // to invert the condition.
+        if (lastBranch.isInitialized())
+            lastBranch.emit(*this);
+        lastBranch = BranchGCPtr();
+
         // Note: Some platforms give the same register for obj and scratch.
         // Make sure when writing to scratch, the obj register isn't used anymore!
         loadPtr(Address(obj, JSObject::offsetOfType()), scratch);
 
         for (unsigned i = 0; i < count; i++) {
             if (!types->getTypeObject(i))
                 continue;