Bug 951346 - Don't improve type information for objects with metadata, r=jimb.
authorBrian Hackett <bhackett1024@gmail.com>
Fri, 21 Feb 2014 12:26:42 -0700
changeset 170274 acfa8a65c4dbfadfa2e06a81f8b1a2a38a10dce0
parent 170273 792ce962cad698a332e5c43c63a208afcc61609b
child 170275 46c9478b570ef7490c386c6febdde3f26ccee791
push id270
push userpvanderbeken@mozilla.com
push dateThu, 06 Mar 2014 09:24:21 +0000
reviewersjimb
bugs951346
milestone30.0a1
Bug 951346 - Don't improve type information for objects with metadata, r=jimb.
js/src/jit-test/tests/basic/bug951346.js
js/src/jsinfer.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug951346.js
@@ -0,0 +1,3 @@
+
+setObjectMetadataCallback(function(obj) {});
+eval(uneval({'-1':true}));
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -2598,17 +2598,22 @@ TypeCompartment::fixObjectType(Exclusive
     }
 
     /*
      * Use the same type object for all singleton/JSON objects with the same
      * base shape, i.e. the same fields written in the same order.
      */
     JS_ASSERT(obj->is<JSObject>());
 
-    if (obj->slotSpan() == 0 || obj->inDictionaryMode() || !obj->hasEmptyElements())
+    /*
+     * Exclude some objects we can't readily associate common types for based on their
+     * shape. Objects with metadata are excluded so that the metadata does not need to
+     * be included in the table lookup (the metadata object might be in the nursery).
+     */
+    if (obj->slotSpan() == 0 || obj->inDictionaryMode() || !obj->hasEmptyElements() || obj->getMetadata())
         return;
 
     Vector<IdValuePair> properties(cx);
     if (!properties.resize(obj->slotSpan())) {
         cx->compartment()->types.setPendingNukeTypes(cx);
         return;
     }