Bug 1054359 - Add is-object check to IonBuilder::makeCallHelper. r=efaust, a=lmandel
authorJan de Mooij <jdemooij@mozilla.com>
Mon, 18 Aug 2014 12:03:55 +0200
changeset 208322 f5bfa8f3434c
parent 208321 c444cb84a78b
child 208323 3741e9a5c6ca
push id3824
push userryanvm@gmail.com
push date2014-08-18 16:06 +0000
treeherdermozilla-beta@f595bdcdbd1e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersefaust, lmandel
bugs1054359
milestone32.0
Bug 1054359 - Add is-object check to IonBuilder::makeCallHelper. r=efaust, a=lmandel
js/src/jit/IonBuilder.cpp
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -5270,16 +5270,17 @@ IonBuilder::makeCallHelper(JSFunction *t
 
     bool isDOMCall = false;
     if (target && !callInfo.constructing()) {
         // We know we have a single call target.  Check whether the "this" types
         // are DOM types and our function a DOM function, and if so flag the
         // MCall accordingly.
         types::TemporaryTypeSet *thisTypes = callInfo.thisArg()->resultTypeSet();
         if (thisTypes &&
+            thisTypes->getKnownMIRType() == MIRType_Object &&
             thisTypes->isDOMClass() &&
             testShouldDOMCall(thisTypes, target, JSJitInfo::Method))
         {
             isDOMCall = true;
         }
     }
 
     MCall *call = MCall::New(alloc(), target, targetArgs + 1, callInfo.argc(),