Bug 1182865 - Relax assertion on the allowed class for home objects, r=efaust
authorBrian Hackett <bhackett1024@gmail.com>
Mon, 03 Aug 2015 14:02:23 -0700
changeset 287641 9834248c89decbac5bd4844740f4a5c718de052d
parent 287640 b8d147ca6d04a342f9971b8b22298622d04dd12f
child 287642 ba77cb6046b78898945248da5fd459a98f97f19c
push id5067
push userraliiev@mozilla.com
push dateMon, 21 Sep 2015 14:04:52 +0000
treeherdermozilla-beta@14221ffe5b2f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersefaust
bugs1182865
milestone42.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1182865 - Relax assertion on the allowed class for home objects, r=efaust
js/src/jit-test/tests/basic/bug1182865.js
js/src/vm/Interpreter.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug1182865.js
@@ -0,0 +1,8 @@
+
+for (var j = 0; j < 99; j++) {
+    Array[{
+        f() {
+            eval()
+        }
+    }];
+}
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -4035,19 +4035,19 @@ CASE(JSOP_INITHOMEOBJECT)
     unsigned skipOver = GET_UINT8(REGS.pc);
     MOZ_ASSERT(REGS.stackDepth() >= skipOver + 2);
 
     /* Load the function to be initialized */
     ReservedRooted<JSFunction*> func(&rootFunction0, &REGS.sp[-1].toObject().as<JSFunction>());
     MOZ_ASSERT(func->allowSuperProperty());
 
     /* Load the home object */
-    ReservedRooted<NativeObject*> obj(&rootNativeObject0);
-    obj = &REGS.sp[int(-2 - skipOver)].toObject().as<NativeObject>();
-    MOZ_ASSERT(obj->is<PlainObject>() || obj->is<JSFunction>());
+    ReservedRooted<JSObject*> obj(&rootObject0);
+    obj = &REGS.sp[int(-2 - skipOver)].toObject();
+    MOZ_ASSERT(obj->is<PlainObject>() || obj->is<UnboxedPlainObject>() || obj->is<JSFunction>());
 
     func->setExtendedSlot(FunctionExtended::METHOD_HOMEOBJECT_SLOT, ObjectValue(*obj));
 }
 END_CASE(JSOP_INITHOMEOBJECT)
 
 CASE(JSOP_SUPERBASE)
 {
     ScopeIter si(cx, REGS.fp()->scopeChain(), REGS.fp()->script()->innermostStaticScope(REGS.pc));