Bug 927195 - Track prototype properties of functions used in instanceof operations, r=jandem.
authorBrian Hackett <bhackett1024@gmail.com>
Wed, 16 Oct 2013 12:27:02 -0600
changeset 164880 d7fe1f3439e276a851a31ea1f499c0cd4a3f8e75
parent 164879 aa29389b72f3f31e6bf5da45557e5f5b3d26a24b
child 164881 b4ebfef56feecc150a0252e4f5a3985501423d3b
push id3066
push userakeybl@mozilla.com
push dateMon, 09 Dec 2013 19:58:46 +0000
treeherdermozilla-beta@a31a0dce83aa [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs927195
milestone27.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 927195 - Track prototype properties of functions used in instanceof operations, r=jandem.
js/src/jit/BaselineIC.cpp
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -8840,16 +8840,21 @@ DoInstanceOfFallback(JSContext *cx, ICIn
 
     if (!rhs.isObject()) {
         js_ReportValueError(cx, JSMSG_BAD_INSTANCEOF_RHS, -1, rhs, NullPtr());
         return false;
     }
 
     RootedObject obj(cx, &rhs.toObject());
 
+    // For functions, keep track of the |prototype| property in type information,
+    // for use during Ion compilation.
+    if (obj->is<JSFunction>() && IsIonEnabled(cx))
+        types::EnsureTrackPropertyTypes(cx, obj, NameToId(cx->names().prototype));
+
     bool cond = false;
     if (!HasInstance(cx, obj, lhs, &cond))
         return false;
 
     res.setBoolean(cond);
     return true;
 }