diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp index 6752dfce36f..dff10348611 100644 --- a/js/src/jit/BaselineIC.cpp +++ b/js/src/jit/BaselineIC.cpp @@ -1969,6 +1969,8 @@ DoCompareFallback(JSContext *cx, BaselineFrame *frame, ICCompare_Fallback *stub_ } } + stub->noteUnoptimizableAccess(); + return true; } diff --git a/js/src/jit/BaselineIC.h b/js/src/jit/BaselineIC.h index d628986af4d..975a56987c3 100644 --- a/js/src/jit/BaselineIC.h +++ b/js/src/jit/BaselineIC.h @@ -1966,6 +1966,14 @@ class ICCompare_Fallback : public ICFallbackStub return space->allocate(code); } + static const size_t UNOPTIMIZABLE_ACCESS_BIT = 0; + void noteUnoptimizableAccess() { + extra_ |= (1u << UNOPTIMIZABLE_ACCESS_BIT); + } + bool hadUnoptimizableAccess() const { + return extra_ & (1u << UNOPTIMIZABLE_ACCESS_BIT); + } + // Compiler for this stub kind. class Compiler : public ICStubCompiler { protected: diff --git a/js/src/jit/BaselineInspector.cpp b/js/src/jit/BaselineInspector.cpp index c35ba78e513..3676ff9f486 100644 --- a/js/src/jit/BaselineInspector.cpp +++ b/js/src/jit/BaselineInspector.cpp @@ -226,6 +226,12 @@ BaselineInspector::expectedCompareType(jsbytecode *pc) if (!first && !dimorphicStub(pc, &first, &second)) return MCompare::Compare_Unknown; + if (ICStub *fallback = second ? second->next() : first->next()) { + JS_ASSERT(fallback->isFallback()); + if (fallback->toCompare_Fallback()->hadUnoptimizableAccess()) + return MCompare::Compare_Unknown; + } + if (CanUseInt32Compare(first->kind()) && (!second || CanUseInt32Compare(second->kind()))) { ICCompare_Int32WithBoolean *coerce = first->isCompare_Int32WithBoolean()