Bug 980119 - Watch for typed arrays with unknown properties when baking in their elements, r=jandem.
authorBrian Hackett <bhackett1024@gmail.com>
Thu, 06 Mar 2014 14:00:29 -0700
changeset 189565 288cea1386a4e5068d092f2c69064f32539c643f
parent 189564 dbaed89f36e98a45dcc719d6c5e8279151b6a40b
child 189566 6f8ea87eb8d135e2f7560e951c459a277d705c81
push id3503
push userraliiev@mozilla.com
push dateMon, 28 Apr 2014 18:51:11 +0000
treeherdermozilla-beta@c95ac01e332e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs980119
milestone30.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 980119 - Watch for typed arrays with unknown properties when baking in their elements, r=jandem.
js/src/jit-test/tests/ion/bug980119.js
js/src/jit/IonBuilder.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug980119.js
@@ -0,0 +1,9 @@
+
+s = newGlobal()
+evalcx("\
+    x = new Uint8ClampedArray;\
+    x.__proto__ = [];\
+", s);
+evalcx("\
+    x[0]\
+", s);
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -7176,20 +7176,22 @@ IonBuilder::getTypedArrayElements(MDefin
         TypedArrayObject *tarr = &obj->toConstant()->value().toObject().as<TypedArrayObject>();
         void *data = tarr->viewData();
         // Bug 979449 - Optimistically embed the elements and use TI to
         //              invalidate if we move them.
         if (!gc::IsInsideNursery(tarr->runtimeFromMainThread(), data)) {
             // The 'data' pointer can change in rare circumstances
             // (ArrayBufferObject::changeContents).
             types::TypeObjectKey *tarrType = types::TypeObjectKey::get(tarr);
-            tarrType->watchStateChangeForTypedArrayBuffer(constraints());
-
-            obj->setImplicitlyUsedUnchecked();
-            return MConstantElements::New(alloc(), data);
+            if (!tarrType->unknownProperties()) {
+                tarrType->watchStateChangeForTypedArrayBuffer(constraints());
+
+                obj->setImplicitlyUsedUnchecked();
+                return MConstantElements::New(alloc(), data);
+            }
         }
     }
     return MTypedArrayElements::New(alloc(), obj);
 }
 
 MDefinition *
 IonBuilder::convertShiftToMaskForStaticTypedArray(MDefinition *id,
                                                   ArrayBufferView::ViewType viewType)