Bug 879723 - Make sure property types reflect inherited types from the prototype when specializing a setgname. r=bhackett, a=lsblakk
authorShu-yu Guo <shu@rfrn.org>
Tue, 11 Jun 2013 21:25:01 -0400
changeset 142872 6f7c753b3abc0f242e63659960cce41a22bdc3d2
parent 142871 944182a5a20459d3356afb86f5686151b83a570a
child 142873 1504352b0676f73a6b184f4c1c8fa6b7a1191803
push id2579
push userakeybl@mozilla.com
push dateMon, 24 Jun 2013 18:52:47 +0000
treeherdermozilla-beta@b69b7de8a05a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett, lsblakk
bugs879723
milestone23.0a2
Bug 879723 - Make sure property types reflect inherited types from the prototype when specializing a setgname. r=bhackett, a=lsblakk
js/src/ion/IonBuilder.cpp
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -6020,17 +6020,24 @@ IonBuilder::jsop_setgname(HandleProperty
     // Pop the global object pushed by bindgname.
     DebugOnly<MDefinition *> pushedGlobal = current->pop();
     JS_ASSERT(&pushedGlobal->toConstant()->value().toObject() == globalObj);
 
     // If the property has a known type, we may be able to optimize typed stores by not
     // storing the type tag. This only works if the property does not have its initial
     // |undefined| value; if |undefined| is assigned at a later point, it will be added
     // to the type set.
+    //
+    // We also need to make sure the typeset reflects the inherited types from
+    // the prototype by calling getFromPrototype. Otherwise we may specialize
+    // on a typeset that becomes unknown before compilation ends, which would
+    // mean the current script wouldn't be compiled even when our assumption
+    // here is made false.
     if (propertyTypes && !globalObj->getSlot(shape->slot()).isUndefined()) {
+        globalType->getFromPrototypes(cx, id, propertyTypes);
         JSValueType knownType = propertyTypes->getKnownTypeTag(cx);
         if (knownType != JSVAL_TYPE_UNKNOWN)
             store->setSlotType(MIRTypeFromValueType(knownType));
     }
 
     JS_ASSERT_IF(store->needsBarrier(), store->slotType() != MIRType_None);
 
     current->push(value);