diff --git a/js/src/jstracer.cpp b/js/src/jstracer.cpp index 19430ef4f6b..ed9739d6d71 100644 --- a/js/src/jstracer.cpp +++ b/js/src/jstracer.cpp @@ -7001,15 +7001,12 @@ JS_REQUIRES_STACK bool TraceRecorder::prop(JSObject* obj, LIns* obj_ins, uint32& slot, LIns*& v_ins) { /* - * If the shape of the object matches the global object's shape, we - * have to guard against aliasing to avoid aliasing stale homes of stacked - * global variables. + * Can't specialize to assert obj != global, must guard to avoid aliasing + * stale homes of stacked global variables. */ - if (OBJ_SHAPE(obj) == OBJ_SHAPE(globalObj)) { - if (obj == globalObj) - ABORT_TRACE("prop op aliases global"); - guard(false, lir->ins2(LIR_eq, obj_ins, globalObj_ins), MISMATCH_EXIT); - } + if (obj == globalObj) + ABORT_TRACE("prop op aliases global"); + guard(false, lir->ins2(LIR_eq, obj_ins, globalObj_ins), MISMATCH_EXIT); /* * Property cache ensures that we are dealing with an existing property, diff --git a/js/src/trace-test.js b/js/src/trace-test.js index 8538aec8d06..86f9d3ece96 100644 --- a/js/src/trace-test.js +++ b/js/src/trace-test.js @@ -4034,19 +4034,6 @@ function testBug474769() { testBug474769.expected = 1; test(testBug474769); -undeclaredGlobal = -1; -function testGlobalAliasCheck() { - var q; - for (var i = 0; i < 10; ++i) { - undeclaredGlobal = i; - q = this.undeclaredGlobal; - } - return q; -} -testGlobalAliasCheck.expected = 9; -test(testGlobalAliasCheck); -delete undeclaredGlobal; - /***************************************************************************** * * * _____ _ _ _____ ______ _____ _______ *