Bug 1081850 - Check for resolve hooks when optimizing no-such-prop operations in baseline. r=jandem, a=lmandel
authorKannan Vijayan <kvijayan@mozilla.com>
Wed, 12 Nov 2014 16:22:44 -0500
changeset 226053 e685be9bd4d6
parent 226052 e1ee2331bd12
child 226054 3e5cb63660bd
push id4126
push userryanvm@gmail.com
push date2014-11-13 21:00 +0000
treeherdermozilla-beta@3e5cb63660bd [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem, lmandel
bugs1081850
milestone34.0
Bug 1081850 - Check for resolve hooks when optimizing no-such-prop operations in baseline. r=jandem, a=lmandel
js/src/jit-test/tests/baseline/bug1081850.js
js/src/jit/BaselineIC.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug1081850.js
@@ -0,0 +1,18 @@
+// |jit-test| ion-eager
+
+var ARR = [];
+try {
+    function f() {
+        ARR.push(eval.prototype)
+    }
+    f()
+    function eval()(0)
+    f()
+} catch (e) {}
+
+if (ARR.length !== 2)
+    throw new Error("ERROR 1");
+if (typeof(ARR[0]) !== 'undefined')
+    throw new Error("ERROR 2");
+if (typeof(ARR[1]) !== 'object')
+    throw new Error("ERROR 3");
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -3354,16 +3354,20 @@ CheckHasNoSuchProperty(JSContext *cx, Ha
     MOZ_ASSERT(protoChainDepthOut != nullptr);
 
     size_t depth = 0;
     RootedObject curObj(cx, obj);
     while (curObj) {
         if (!curObj->isNative())
             return false;
 
+        // Don't handle proto chains with resolve hooks.
+        if (curObj->getClass()->resolve != JS_ResolveStub)
+            return false;
+
         Shape *shape = curObj->nativeLookup(cx, NameToId(name));
         if (shape)
             return false;
 
         JSObject *proto = curObj->getTaggedProto().toObjectOrNull();
         if (!proto)
             break;