From 9cc0784c1ae1866f66b1128508b9796994c305a3 Mon Sep 17 00:00:00 2001 From: Andreas Gal Date: Tue, 2 Jun 2009 20:03:58 -0700 Subject: [PATCH] Fall off trace if 'this' is a 'with' object (496057, r=mrbkap). --- js/src/jstracer.cpp | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/js/src/jstracer.cpp b/js/src/jstracer.cpp index 4ce98e96fbe..d7cbb596705 100644 --- a/js/src/jstracer.cpp +++ b/js/src/jstracer.cpp @@ -6729,7 +6729,15 @@ TraceRecorder::getThis(LIns*& this_ins) /* * js_ComputeThisForFrame updates cx->fp->argv[-1], so sample it into 'original' first. */ - jsval original = cx->fp->callee ? cx->fp->argv[-1] : JSVAL_NULL; + jsval original = JSVAL_NULL; + if (cx->fp->callee) { + original = cx->fp->argv[-1]; + if (!JSVAL_IS_PRIMITIVE(original) && + guardClass(JSVAL_TO_OBJECT(original), get(&cx->fp->argv[-1]), &js_WithClass, snapshot(MISMATCH_EXIT))) { + ABORT_TRACE("can't trace getThis on With object"); + } + } + JSObject* thisObj = js_ComputeThisForFrame(cx, cx->fp); if (!thisObj) ABORT_TRACE_ERROR("js_ComputeThisForName failed"); @@ -6766,9 +6774,6 @@ TraceRecorder::getThis(LIns*& this_ins) } this_ins = get(&thisv); - if (guardClass(JSVAL_TO_OBJECT(thisv), this_ins, &js_WithClass, snapshot(MISMATCH_EXIT))) - ABORT_TRACE("can't trace getThis on With object"); - /* * The only unwrapped object that needs to be wrapped that we can get here is the * global object obtained throught the scope chain.