Bug 1328834 - Check hasScript in IonBuilder::createThisScriptedSingleton. r=h4writer, a=jcristau
authorJan de Mooij <jdemooij@mozilla.com>
Tue, 10 Jan 2017 11:52:59 +0100
changeset 312564 0521b0e4707c594cd8e50598617b0337b3fb784d
parent 312563 a386ca6a30133688aebcea4bba3ddc53c6a7ce89
child 312565 41262e8553115cca8a6ea21779b94611a446f5bd
push id371
push userryanvm@gmail.com
push dateTue, 10 Jan 2017 19:20:20 +0000
treeherdermozilla-esr45@0521b0e4707c [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersh4writer, jcristau
bugs1328834
milestone45.6.1
Bug 1328834 - Check hasScript in IonBuilder::createThisScriptedSingleton. r=h4writer, a=jcristau
js/src/jit/IonBuilder.cpp
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -6130,16 +6130,19 @@ IonBuilder::getSingletonPrototype(JSFunc
     HeapTypeSetKey protoProperty = targetKey->property(protoid);
 
     return protoProperty.singleton(constraints());
 }
 
 MDefinition*
 IonBuilder::createThisScriptedSingleton(JSFunction* target, MDefinition* callee)
 {
+    if (!target->hasScript())
+        return nullptr;
+
     // Get the singleton prototype (if exists)
     JSObject* proto = getSingletonPrototype(target);
     if (!proto)
         return nullptr;
 
     JSObject* templateObject = inspector->getTemplateObject(pc);
     if (!templateObject)
         return nullptr;