Bug 1509293: Add missing lazyProtoCheck to tryAttachArrayPush r=djvj
authorMatthew Gaudet <mgaudet@mozilla.com>
Wed, 28 Nov 2018 17:52:16 +0000
changeset 504987 da3635436bf11b00795861958e251249a8fe005c
parent 504986 393f02fb1ad734a1f37a2c33ac29050a3130cb23
child 504988 eefaa80b67451e8213c63421a7cbccc2824513dd
push id10290
push userffxbld-merge
push dateMon, 03 Dec 2018 16:23:23 +0000
treeherdermozilla-beta@700bed2445e6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdjvj
bugs1509293
milestone65.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1509293: Add missing lazyProtoCheck to tryAttachArrayPush r=djvj Differential Revision: https://phabricator.services.mozilla.com/D12787
js/src/jit/CacheIR.cpp
--- a/js/src/jit/CacheIR.cpp
+++ b/js/src/jit/CacheIR.cpp
@@ -5047,16 +5047,20 @@ CallIRGenerator::tryAttachArrayPush()
     }
 
     // Where |obj| is a native array.
     RootedObject thisobj(cx_, &thisval_.toObject());
     if (!thisobj->is<ArrayObject>()) {
         return false;
     }
 
+    if (thisobj->hasLazyGroup()) {
+        return false;
+    }
+
     RootedArrayObject thisarray(cx_, &thisobj->as<ArrayObject>());
 
     // And the object group for the array is not collecting preliminary objects.
     AutoSweepObjectGroup sweep(thisobj->group());
     if (thisobj->group()->maybePreliminaryObjects(sweep)) {
         return false;
     }