Bug 1261326 - Fix a bogus assert. r=bhackett
authorJan de Mooij <jdemooij@mozilla.com>
Sat, 23 Apr 2016 23:11:13 +0200
changeset 332560 5d3ac1da48e0ba42362b7531b0a345d477e0770c
parent 332559 1f1bf431eb48d39d1d97280d2170d7f687b4a094
child 332561 ff82389380c1e4c550314ffe536191075a405b0b
push id6048
push userkmoir@mozilla.com
push dateMon, 06 Jun 2016 19:02:08 +0000
treeherdermozilla-beta@46d72a56c57d [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett
bugs1261326
milestone48.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1261326 - Fix a bogus assert. r=bhackett
js/src/jit-test/tests/ion/bug1261326.js
js/src/jit/IonBuilder.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1261326.js
@@ -0,0 +1,11 @@
+x = x = "";
+function Obj1(x) {
+    this.x = x;
+}
+function f() {
+    var o = {};
+    for (var i = 0; i < 1500; i++)
+        new Obj1(o);
+    Obj1('');
+}
+f();
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -12216,19 +12216,23 @@ IonBuilder::getPropTryInlineAccess(bool*
                 return false;
 
             trackOptimizationOutcome(TrackedOutcome::Monomorphic);
             *emitted = true;
             return true;
         }
 
         // Monomorphic load from an unboxed object.
-        obj = addGroupGuard(obj, receivers[0].group, Bailout_ShapeGuard);
-
-        const UnboxedLayout::Property* property = receivers[0].group->unboxedLayout().lookup(name);
+        ObjectGroup* group = receivers[0].group;
+        if (obj->resultTypeSet() && !obj->resultTypeSet()->hasType(TypeSet::ObjectType(group)))
+            return true;
+
+        obj = addGroupGuard(obj, group, Bailout_ShapeGuard);
+
+        const UnboxedLayout::Property* property = group->unboxedLayout().lookup(name);
         MInstruction* load = loadUnboxedProperty(obj, property->offset, property->type, barrier, types);
         current->push(load);
 
         if (!pushTypeBarrier(load, types, barrier))
             return false;
 
         trackOptimizationOutcome(TrackedOutcome::Monomorphic);
         *emitted = true;
@@ -12972,16 +12976,19 @@ IonBuilder::setPropTryInlineAccess(bool*
             *emitted = true;
             return true;
         }
 
         // Monomorphic store to an unboxed object.
         spew("Inlining monomorphic unboxed SETPROP");
 
         ObjectGroup* group = receivers[0].group;
+        if (!objTypes->hasType(TypeSet::ObjectType(group)))
+            return true;
+
         obj = addGroupGuard(obj, group, Bailout_ShapeGuard);
 
         const UnboxedLayout::Property* property = group->unboxedLayout().lookup(name);
         storeUnboxedProperty(obj, property->offset, property->type, value);
 
         current->push(value);
 
         trackOptimizationOutcome(TrackedOutcome::Monomorphic);