Fix inverted test, improve test when marking objects with uncacheable prototypes, bug 703047.
authorBrian Hackett <bhackett1024@gmail.com>
Fri, 25 Nov 2011 17:45:41 -0500
changeset 82981 39a0770a0541d0b6fc22eb0cf575d9a634010448
parent 82980 195998f4718e89204f49ed26eb58cb3c997f956c
child 82982 60f879bef90ef16c268b0230cf14ea20ae31c234
push id519
push userakeybl@mozilla.com
push dateWed, 01 Feb 2012 00:38:35 +0000
treeherdermozilla-beta@788ea1ef610b [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs703047
milestone11.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Fix inverted test, improve test when marking objects with uncacheable prototypes, bug 703047.
js/src/jsobj.cpp
js/src/methodjit/PolyIC.cpp
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -4972,21 +4972,23 @@ SetProto(JSContext *cx, JSObject *obj, J
     if (proto && proto->isXML()) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_XML_PROTO_FORBIDDEN);
         return false;
     }
 
     /*
      * Regenerate shapes for all of the scopes along the old prototype chain,
      * in case any entries were filled by looking up through obj. Stop when an
-     * object with a non-native object is found, prototype lookups will not be
-     * cached across these.
+     * object with an uncacheable prototype or a non-native object is found,
+     * prototype lookups will not be cached across these.
      */
     JSObject *oldproto = obj;
-    while (oldproto && oldproto->isNative()) {
+    while (oldproto->getProto() &&
+           oldproto->isNative() &&
+           !oldproto->hasUncacheableProto()) {
         if (!oldproto->protoShapeChange(cx))
             return false;
         oldproto = oldproto->getProto();
     }
 
     if (checkForCycles) {
         for (JSObject *obj2 = proto; obj2; obj2 = obj2->getProto()) {
             if (obj2 == obj) {
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -521,17 +521,17 @@ class SetPropCompiler : public PICStubCo
                 return disable("index");
 
             /*
              * When adding a property we need to check shapes along the entire
              * prototype chain to watch for an added setter.
              */
             JSObject *proto = obj;
             while (proto) {
-                if (proto->hasUncacheableProto() || proto->isNative())
+                if (proto->hasUncacheableProto() || !proto->isNative())
                     return disable("non-cacheable proto");
                 proto = proto->getProto();
             }
 
             const Shape *initialShape = obj->lastProperty();
             uint32 slots = obj->numDynamicSlots();
 
             uintN flags = 0;