Bug 973238 Part 6 -- Consult prototype rather than typed object addendum r=bhackett
authorNicholas D. Matsakis <nmatsakis@mozilla.com>
Tue, 11 Mar 2014 13:23:24 -0400
changeset 206610 4903226b4f2ff4f6c44fe08e91e5dff0e163741d
parent 206609 89bd60c2a4df5200c84cc223013b661ae28c71ec
child 206611 3e9ea27401838363e58d8908bd320ef13fd8d04f
push id3741
push userasasaki@mozilla.com
push dateMon, 21 Jul 2014 20:25:18 +0000
treeherdermozilla-beta@4d6f46f5af68 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett
bugs973238
milestone32.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 973238 Part 6 -- Consult prototype rather than typed object addendum r=bhackett
CLOBBER
js/src/jit/IonBuilder.cpp
--- a/CLOBBER
+++ b/CLOBBER
@@ -17,9 +17,9 @@
 #
 # Modifying this file will now automatically clobber the buildbot machines \o/
 #
 
 # Are you updating CLOBBER because you think it's needed for your WebIDL
 # changes to stick? As of bug 928195, this shouldn't be necessary! Please
 # don't change CLOBBER for WebIDL changes any more.
 
-Bug 973238 part 5 needs clobber due to self-hosted code (bug 1019955).
+Bug 973238 part 6 needs clobber due to self-hosted code (bug 1019955).
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -10259,24 +10259,30 @@ IonBuilder::typeSetToTypeDescrSet(types:
 
     // And only known objects.
     if (types->unknownObject())
         return true;
 
     TypeDescrSetBuilder set;
     for (uint32_t i = 0; i < types->getObjectCount(); i++) {
         types::TypeObject *type = types->getTypeObject(i);
-        if (!type || type->unknownProperties())
+        if (!type)
+            return true;
+
+        if (!IsTypedObjectClass(type->clasp()))
             return true;
 
-        if (!type->hasTypedObject())
-            return true;
-
-        TypeDescr &descr = type->typedObject()->descr();
-        if (!set.insert(&descr))
+        TaggedProto proto = type->proto();
+
+        // typed objects have immutable prototypes, and they are
+        // always instances of TypedProto
+        JS_ASSERT(proto.isObject() && proto.toObject()->is<TypedProto>());
+
+        TypedProto &typedProto = proto.toObject()->as<TypedProto>();
+        if (!set.insert(&typedProto.typeDescr()))
             return false;
     }
 
     return set.build(*this, out);
 }
 
 MDefinition *
 IonBuilder::loadTypedObjectType(MDefinition *typedObj)