Bug 1148375 - Ignore unhandled Elements. r=jandem, a=lizzard
authorSean Stangl <sstangl@mozilla.com>
Mon, 30 Mar 2015 13:34:19 -0700
changeset 267350 836f6b1688468729b7da9225a39cb058a37e41e9
parent 267349 5822851d291182d06feade235dd463748a190740
child 267351 8d0f31b22060d436b9946800f025807f2780a440
push id830
push userraliiev@mozilla.com
push dateFri, 19 Jun 2015 19:24:37 +0000
treeherdermozilla-release@932614382a68 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem, lizzard
bugs1148375
milestone39.0a2
Bug 1148375 - Ignore unhandled Elements. r=jandem, a=lizzard
js/src/jit/MIR.cpp
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -4186,32 +4186,38 @@ MaybeUnwrapElements(const MDefinition* e
     // Sometimes there is a level of indirection for conversion.
     if (elementsOrObj->isConvertElementsToDoubles())
         return MaybeUnwrapElements(elementsOrObj->toConvertElementsToDoubles()->elements());
 
     // For inline elements, the object may be passed directly, for example as MUnbox.
     if (elementsOrObj->type() == MIRType_Object)
         return nullptr;
 
+    // MTypedArrayElements and MTypedObjectElements aren't handled.
+    if (!elementsOrObj->isElements())
+        return nullptr;
+
     return elementsOrObj->toElements();
 }
 
 // Gets the MDefinition of the target Object for the given store operation.
 static inline const MDefinition*
 GetStoreObject(const MDefinition* store)
 {
     switch (store->op()) {
       case MDefinition::Op_StoreElement: {
         const MDefinition* elementsOrObj = store->toStoreElement()->elements();
+        if (elementsOrObj->type() == MIRType_Object)
+            return elementsOrObj;
+
         const MDefinition* elements = MaybeUnwrapElements(elementsOrObj);
         if (elements)
             return elements->toElements()->input();
 
-        MOZ_ASSERT(elementsOrObj->type() == MIRType_Object);
-        return elementsOrObj;
+        return nullptr;
       }
 
       case MDefinition::Op_StoreElementHole:
         return store->toStoreElementHole()->object();
 
       default:
         return nullptr;
     }
@@ -4220,17 +4226,21 @@ GetStoreObject(const MDefinition* store)
 // Implements mightAlias() logic common to all load operations.
 static bool
 GenericLoadMightAlias(const MDefinition* elementsOrObj, const MDefinition* store)
 {
     const MElements* elements = MaybeUnwrapElements(elementsOrObj);
     if (elements)
         return elements->mightAlias(store);
 
-    // If MElements couldn't be extracted, then storage must be inline.
+    // Unhandled Elements kind.
+    if (elementsOrObj->type() != MIRType_Object)
+        return true;
+
+    // Inline storage for objects.
     // Refer to IsValidElementsType().
     const MDefinition* object = elementsOrObj;
     MOZ_ASSERT(object->type() == MIRType_Object);
     if (!object->resultTypeSet())
         return true;
 
     const MDefinition* storeObject = GetStoreObject(store);
     if (!storeObject)