Bug 986678 - Fix type check in TryAddTypeBarrierForWrite. r=bhackett, a=abillings
authorJan de Mooij <jdemooij@mozilla.com>
Fri, 04 Apr 2014 19:38:10 +0200
changeset 183665 c19e0e0a8535
parent 183664 3f2d6f68c415
child 183666 ed9793adc2c7
push id3440
push userryanvm@gmail.com
push date2014-04-08 16:22 +0000
treeherdermozilla-beta@ed9793adc2c7 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett, abillings
bugs986678
milestone29.0
Bug 986678 - Fix type check in TryAddTypeBarrierForWrite. r=bhackett, a=abillings
js/src/jit/MIR.cpp
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -3247,20 +3247,20 @@ TryAddTypeBarrierForWrite(TempAllocator 
     MIRType propertyType = MIRTypeFromValueType(aggregateProperty.ref().knownTypeTag(constraints));
     switch (propertyType) {
       case MIRType_Boolean:
       case MIRType_Int32:
       case MIRType_Double:
       case MIRType_String: {
         // The property is a particular primitive type, guard by unboxing the
         // value before the write.
-        if ((*pvalue)->type() != MIRType_Value) {
-            // The value is a different primitive, just do a VM call as it will
-            // always trigger invalidation of the compiled code.
-            JS_ASSERT((*pvalue)->type() != propertyType);
+        if (!(*pvalue)->mightBeType(propertyType)) {
+            // The value's type does not match the property type. Just do a VM
+            // call as it will always trigger invalidation of the compiled code.
+            JS_ASSERT_IF((*pvalue)->type() != MIRType_Value, (*pvalue)->type() != propertyType);
             return false;
         }
         MInstruction *ins = MUnbox::New(alloc, *pvalue, propertyType, MUnbox::Fallible);
         current->add(ins);
         *pvalue = ins;
         return true;
       }
       default:;