Bug 1125389 - Fix NewReshapedObject to use the old shape's data. r=jandem, a=abillings
authorBrian Hackett <bhackett1024@gmail.com>
Thu, 29 Jan 2015 11:50:43 -0700
changeset 249491 b2c29669f13a139c5eb99bfa91cf10bd27b7cf47
parent 249490 829537f1f2710e42911cd7142734912217f426d0
child 249492 af25a4300b47095d39970ab7eea1bacf7d9596e2
push id4489
push userraliiev@mozilla.com
push dateMon, 23 Feb 2015 15:17:55 +0000
treeherdermozilla-beta@fd7c3dc24146 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem, abillings
bugs1125389
milestone37.0a2
Bug 1125389 - Fix NewReshapedObject to use the old shape's data. r=jandem, a=abillings
js/src/jsinfer.cpp
js/src/vm/Shape.cpp
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -3948,18 +3948,23 @@ TypeNewScript::maybeAnalyze(JSContext *c
     for (size_t i = 0; i < PRELIMINARY_OBJECT_COUNT; i++) {
         PlainObject *obj = preliminaryObjects[i];
         if (!obj)
             continue;
 
         // For now, we require all preliminary objects to have only simple
         // lineages of plain data properties.
         Shape *shape = obj->lastProperty();
-        if (shape->inDictionary() || !OnlyHasDataProperties(shape))
+        if (shape->inDictionary() ||
+            !OnlyHasDataProperties(shape) ||
+            shape->getObjectFlags() != 0 ||
+            shape->getObjectMetadata() != nullptr)
+        {
             return true;
+        }
 
         maxSlotSpan = Max<size_t>(maxSlotSpan, obj->slotSpan());
 
         if (prefixShape) {
             MOZ_ASSERT(shape->numFixedSlots() == prefixShape->numFixedSlots());
             prefixShape = CommonPrefix(prefixShape, shape);
         } else {
             prefixShape = shape;
--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -648,17 +648,22 @@ js::NewReshapedObject(JSContext *cx, Han
         while (!nshape->isEmptyShape()) {
             ids[nshape->slot()].set(nshape->propid());
             nshape = nshape->previous();
         }
     }
 
     /* Construct the new shape, without updating type information. */
     RootedId id(cx);
-    RootedShape newShape(cx, res->lastProperty());
+    RootedShape newShape(cx, EmptyShape::getInitialShape(cx, res->getClass(),
+                                                         res->getTaggedProto(),
+                                                         res->getMetadata(),
+                                                         res->getParent(),
+                                                         res->numFixedSlots(),
+                                                         shape->getObjectFlags()));
     for (unsigned i = 0; i < ids.length(); i++) {
         id = ids[i];
         MOZ_ASSERT(!res->contains(cx, id));
 
         uint32_t index;
         bool indexed = js_IdIsIndex(id, &index);
 
         Rooted<UnownedBaseShape*> nbase(cx, newShape->base()->unowned());