Bug 1125389 - Fix NewReshapedObject to use the old shape's data. r=jandem, a=abillings
authorBrian Hackett <bhackett1024@gmail.com>
Thu, 29 Jan 2015 11:50:43 -0700
changeset 243603 26d78b7b0bfa
parent 243602 bbdf662015c0
child 243604 1ec36b2a9775
push id4411
push userryanvm@gmail.com
push date2015-01-30 20:02 +0000
treeherdermozilla-beta@03be92be95c2 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem, abillings
bugs1125389
milestone36.0
Bug 1125389 - Fix NewReshapedObject to use the old shape's data. r=jandem, a=abillings
js/src/jsinfer.cpp
js/src/vm/Shape.cpp
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -3948,18 +3948,23 @@ TypeNewScript::maybeAnalyze(JSContext *c
     for (size_t i = 0; i < PRELIMINARY_OBJECT_COUNT; i++) {
         NativeObject *obj = preliminaryObjects[i];
         if (!obj)
             continue;
 
         // For now, we require all preliminary objects to have only simple
         // lineages of plain data properties.
         Shape *shape = obj->lastProperty();
-        if (shape->inDictionary() || !OnlyHasDataProperties(shape))
+        if (shape->inDictionary() ||
+            !OnlyHasDataProperties(shape) ||
+            shape->getObjectFlags() != 0 ||
+            shape->getObjectMetadata() != nullptr)
+        {
             return true;
+        }
 
         maxSlotSpan = Max<size_t>(maxSlotSpan, obj->slotSpan());
 
         if (prefixShape) {
             MOZ_ASSERT(shape->numFixedSlots() == prefixShape->numFixedSlots());
             prefixShape = CommonPrefix(prefixShape, shape);
         } else {
             prefixShape = shape;
--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -699,17 +699,22 @@ js::NewReshapedObject(JSContext *cx, Han
         while (!nshape->isEmptyShape()) {
             ids[nshape->slot()].set(nshape->propid());
             nshape = nshape->previous();
         }
     }
 
     /* Construct the new shape, without updating type information. */
     RootedId id(cx);
-    RootedShape newShape(cx, res->lastProperty());
+    RootedShape newShape(cx, EmptyShape::getInitialShape(cx, res->getClass(),
+                                                         res->getTaggedProto(),
+                                                         res->getMetadata(),
+                                                         res->getParent(),
+                                                         res->numFixedSlots(),
+                                                         shape->getObjectFlags()));
     for (unsigned i = 0; i < ids.length(); i++) {
         id = ids[i];
         MOZ_ASSERT(!res->contains(cx, id));
 
         uint32_t index;
         bool indexed = js_IdIsIndex(id, &index);
 
         Rooted<UnownedBaseShape*> nbase(cx, newShape->base()->unowned());