Bug 1328834 - Check hasScript in IonBuilder::createThisScriptedSingleton. r=h4writer, a=jcristau
authorJan de Mooij <jdemooij@mozilla.com>
Tue, 10 Jan 2017 11:52:59 +0100
changeset 357144 d60102a285f082eb647f74ede2b7c534438e4363
parent 357141 c0657ef3e5a630e6eabf4cb54a5a6cd188bf99fe
child 357145 4c1ef5da347e1314f86d712c284f9089e1ceaa59
push id6761
push userryanvm@gmail.com
push dateTue, 10 Jan 2017 19:17:57 +0000
treeherdermozilla-beta@95d20a617288 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersh4writer, jcristau
bugs1328834
milestone51.0
Bug 1328834 - Check hasScript in IonBuilder::createThisScriptedSingleton. r=h4writer, a=jcristau
js/src/jit/IonBuilder.cpp
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -6320,16 +6320,19 @@ IonBuilder::getSingletonPrototype(JSFunc
     HeapTypeSetKey protoProperty = targetKey->property(protoid);
 
     return protoProperty.singleton(constraints());
 }
 
 MDefinition*
 IonBuilder::createThisScriptedSingleton(JSFunction* target, MDefinition* callee)
 {
+    if (!target->hasScript())
+        return nullptr;
+
     // Get the singleton prototype (if exists)
     JSObject* proto = getSingletonPrototype(target);
     if (!proto)
         return nullptr;
 
     JSObject* templateObject = inspector->getTemplateObject(pc);
     if (!templateObject)
         return nullptr;