Bug 861419 - Consider values in prototype when reading global names during Ion compilation.
authorBrian Hackett <bhackett1024@gmail.com>
Sun, 14 Apr 2013 06:40:58 -0600
changeset 140542 a8d0317c24c10ca62ad112914f77016472b4b217
parent 140541 79f78c194329eefadfffdd122e33007317a3e5e0
child 140543 75ff34ead9fca46a2def4628f01b3e9bafe6459c
push id2579
push userakeybl@mozilla.com
push dateMon, 24 Jun 2013 18:52:47 +0000
treeherdermozilla-beta@b69b7de8a05a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs861419
milestone23.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 861419 - Consider values in prototype when reading global names during Ion compilation.
js/src/ion/IonBuilder.cpp
js/src/jit-test/tests/ion/bug861419.js
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -5631,16 +5631,18 @@ IonBuilder::jsop_getgname(HandleProperty
         if (!propertyTypes)
             return false;
     }
     if (propertyTypes && propertyTypes->isOwnProperty(cx, globalType, true)) {
         // The property has been reconfigured as non-configurable, non-enumerable
         // or non-writable.
         return jsop_getname(name);
     }
+    if (!propertyTypes->hasPropagatedProperty())
+        globalType->getFromPrototypes(cx, id, propertyTypes);
 
     // If the property is permanent, a shape guard isn't necessary.
 
     types::StackTypeSet *types = script()->analysis()->bytecodeTypes(pc);
     bool barrier = !propertyTypes || !propertyTypes->isSubset(types);
     if (!barrier)
         propertyTypes->addFreeze(cx);
 
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug861419.js
@@ -0,0 +1,17 @@
+
+try {
+    arguments.toSource = (function() {
+        __proto__.y = x
+    })
+    y = this
+    print(x = 8)
+    a = arguments
+    for (v of this) {}
+} catch (e) {}
+function f() {
+  "HELLO " + y
+}
+f()
+f()
+y = 1[7]
+f()