Bug 1216130 - Fix extra checks for unboxed objects in PropertyWriteNeedsTypeBarrier. r=bhackett, a=lizzard
authorJan de Mooij <jdemooij@mozilla.com>
Tue, 17 Nov 2015 18:54:06 +0100
changeset 305580 7d63a6f2d3592aafe729a6bc684935d5f80ace5e
parent 305579 09bfa4e72dbf835a4b370d301044d92ba712cfde
child 305581 c642a03ec545403a18a840001295c6708829691c
push id1001
push userraliiev@mozilla.com
push dateMon, 18 Jan 2016 19:06:03 +0000
treeherdermozilla-release@8b89261f3ac4 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett, lizzard
bugs1216130
milestone44.0a2
Bug 1216130 - Fix extra checks for unboxed objects in PropertyWriteNeedsTypeBarrier. r=bhackett, a=lizzard
js/src/jit/MIR.cpp
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -5500,20 +5500,23 @@ jit::PropertyWriteNeedsTypeBarrier(TempA
             // or a VM call is required. A VM call is always required if pobj
             // and pvalue cannot be modified.
             if (!canModify)
                 return true;
             success = TryAddTypeBarrierForWrite(alloc, constraints, current, types, name, pvalue,
                                                 implicitType);
             break;
         }
-
-        // Perform additional filtering to make sure that any unboxed property
-        // being written can accommodate the value.
-        if (key->isGroup() && key->group()->maybeUnboxedLayout()) {
+    }
+
+    // Perform additional filtering to make sure that any unboxed property
+    // being written can accommodate the value.
+    for (size_t i = 0; i < types->getObjectCount(); i++) {
+        TypeSet::ObjectKey* key = types->getObject(i);
+        if (key && key->isGroup() && key->group()->maybeUnboxedLayout()) {
             const UnboxedLayout& layout = key->group()->unboxedLayout();
             if (name) {
                 const UnboxedLayout::Property* property = layout.lookup(name);
                 if (property && !CanStoreUnboxedType(alloc, property->type, *pvalue))
                     return true;
             } else {
                 if (layout.isArray() && !CanStoreUnboxedType(alloc, layout.elementType(), *pvalue))
                     return true;