Bug 1500920 - Correct branchIfPretenuredGroup r=jandem
authorMatthew Gaudet <mgaudet@mozilla.com>
Wed, 24 Oct 2018 14:32:57 +0000
changeset 491157 486615f18dd75bebea50fbbb1154b67d8b915426
parent 491156 a90b3d91f1a442866f0cae3a350701f48056c895
child 491158 1a0b7f5e0282052c0bd67a98143cdcd2c4cb39fa
push id247
push userfmarier@mozilla.com
push dateSat, 27 Oct 2018 01:06:44 +0000
reviewersjandem
bugs1500920
milestone65.0a1
Bug 1500920 - Correct branchIfPretenuredGroup r=jandem Depends on D9388 Differential Revision: https://phabricator.services.mozilla.com/D9605
js/src/jit/MacroAssembler.cpp
--- a/js/src/jit/MacroAssembler.cpp
+++ b/js/src/jit/MacroAssembler.cpp
@@ -3408,18 +3408,25 @@ MacroAssembler::branchIfPretenuredGroup(
 {
     movePtr(ImmGCPtr(group), scratch);
     branchIfPretenuredGroup(scratch, label);
 }
 
 void
 MacroAssembler::branchIfPretenuredGroup(Register group, Label* label)
 {
+    // To check for the pretenured flag we need OBJECT_FLAG_PRETENURED set, and
+    // OBJECT_FLAG_UNKNOWN_PROPERTIES unset, so check the latter first, and don't
+    // branch if it set.
+    Label unknownProperties;
+    branchTest32(Assembler::NonZero, Address(group, ObjectGroup::offsetOfFlags()),
+                Imm32(OBJECT_FLAG_UNKNOWN_PROPERTIES), &unknownProperties);
     branchTest32(Assembler::NonZero, Address(group, ObjectGroup::offsetOfFlags()),
                  Imm32(OBJECT_FLAG_PRE_TENURE), label);
+    bind(&unknownProperties);
 }
 
 
 void
 MacroAssembler::branchIfNonNativeObj(Register obj, Register scratch, Label* label)
 {
     loadObjClassUnsafe(obj, scratch);
     branchTest32(Assembler::NonZero, Address(scratch, Class::offsetOfFlags()),