Bug 926847 - Watch for shapes without slots when looking for undefined properties, r=jandem.
authorBrian Hackett <bhackett1024@gmail.com>
Wed, 16 Oct 2013 12:21:09 -0600
changeset 164879 aa29389b72f3f31e6bf5da45557e5f5b3d26a24b
parent 164878 df950d461d3ee0f74c02c87e3b361e8dfaa335a4
child 164880 d7fe1f3439e276a851a31ea1f499c0cd4a3f8e75
push id3066
push userakeybl@mozilla.com
push dateMon, 09 Dec 2013 19:58:46 +0000
treeherdermozilla-beta@a31a0dce83aa [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs926847
milestone27.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 926847 - Watch for shapes without slots when looking for undefined properties, r=jandem.
js/src/jit/MIR.cpp
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -2797,16 +2797,17 @@ PropertyReadNeedsTypeBarrier(JSContext *
 
     // Type information for singleton objects is not required to reflect the
     // initial 'undefined' value for native properties, in particular global
     // variables declared with 'var'. Until the property is assigned a value
     // other than undefined, a barrier is required.
     if (name && object->singleton() && object->singleton()->isNative()) {
         Shape *shape = object->singleton()->nativeLookup(cx, name);
         if (shape &&
+            shape->hasSlot() &&
             shape->hasDefaultGetter() &&
             object->singleton()->nativeGetSlot(shape->slot()).isUndefined())
         {
             return true;
         }
     }
 
     property.freeze(constraints);