[INFER] Record isOwnProperty dependencies on actual property types in jsop_getgname, bug 619433.

This commit is contained in:
Brian Hackett 2011-05-22 08:31:01 -07:00
parent 33c8ca3f88
commit 17ea85886f
3 changed files with 9 additions and 10 deletions

View File

@ -4,7 +4,7 @@ var x = "failure";
function main() { x = "success"; }
/* The JSOP_STOP in a. */
trap(main, 11, "");
trap(main, 10, "");
main();
assertEq(x, "success");

View File

@ -3,12 +3,12 @@ setDebug(true);
x = "notset";
function main() {
/* JSOP_STOP in main. */
untrap(main, 27);
untrap(main, 26);
x = "success";
}
function failure() { x = "failure"; }
/* JSOP_STOP in main. */
trap(main, 27, "failure()");
trap(main, 26, "failure()");
main();
assertEq(x, "success");

View File

@ -5856,19 +5856,18 @@ mjit::Compiler::jsop_getgname(uint32 index)
* pushed type set (if this is a GETGNAME op, and the property may have
* a type barrier on it).
*/
types::TypeSet *types;
if (JSOp(*PC) == JSOP_GETGNAME || JSOp(*PC) == JSOP_CALLGNAME)
types = pushedTypeSet(0);
else
types = globalObj->getType()->getProperty(cx, id, false);
if (!types)
types::TypeSet *propertyTypes = globalObj->getType()->getProperty(cx, id, false);
if (!propertyTypes)
return;
types::TypeSet *types = (JSOp(*PC) == JSOP_GETGNAME || JSOp(*PC) == JSOP_CALLGNAME)
? pushedTypeSet(0)
: propertyTypes;
type = types->getKnownTypeTag(cx);
const js::Shape *shape = globalObj->nativeLookup(ATOM_TO_JSID(atom));
if (shape && shape->hasDefaultGetterOrIsMethod() && shape->hasSlot()) {
Value *value = &globalObj->getSlotRef(shape->slot);
if (!value->isUndefined() && !types->isOwnProperty(cx, true)) {
if (!value->isUndefined() && !propertyTypes->isOwnProperty(cx, true)) {
watchGlobalReallocation();
RegisterID reg = frame.allocReg();
masm.move(ImmPtr(value), reg);