mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
Bug 909601 - Don't optimize common accessors on objects with {get,set}Generic hooks. (r=jandem)
This commit is contained in:
parent
725c93a76e
commit
61a2982620
10
js/src/jit-test/tests/ion/bug909601.js
Normal file
10
js/src/jit-test/tests/ion/bug909601.js
Normal file
@ -0,0 +1,10 @@
|
||||
// |jit-test| ion-eager
|
||||
for (var i=0; i<3; i++)
|
||||
z = new Int32Array;
|
||||
|
||||
function f() {
|
||||
z.__proto__ = 2;
|
||||
}
|
||||
|
||||
for (var i=0; i<3; i++)
|
||||
f();
|
@ -7601,6 +7601,13 @@ IonBuilder::TestCommonPropFunc(JSContext *cx, types::StackTypeSet *types, Handle
|
||||
if (typeObj->unknownProperties())
|
||||
return true;
|
||||
|
||||
// If the class of the object has a hook, we can't
|
||||
// inline, as we would need to call the hook.
|
||||
if (isGetter && typeObj->clasp->ops.getGeneric)
|
||||
return true;
|
||||
if (!isGetter && typeObj->clasp->ops.setGeneric)
|
||||
return true;
|
||||
|
||||
// If the type has an own property, we can't be sure we don't shadow
|
||||
// the chain.
|
||||
types::HeapTypeSet *propSet = typeObj->getProperty(cx, types::IdToTypeId(id), false);
|
||||
@ -7662,13 +7669,21 @@ IonBuilder::TestCommonPropFunc(JSContext *cx, types::StackTypeSet *types, Handle
|
||||
else if (foundProto != proto)
|
||||
return true;
|
||||
|
||||
JSObject *stopAt = foundProto->getProto();
|
||||
while (curObj != stopAt) {
|
||||
// Don't optimize if we have a hook that would have to be called.
|
||||
if (isGetter && curObj->getClass()->ops.getGeneric)
|
||||
return true;
|
||||
if (!isGetter && curObj->getClass()->ops.setGeneric)
|
||||
return true;
|
||||
|
||||
// Check here to make sure that everyone has Type Objects with known
|
||||
// properties between them and the proto we found the accessor on. We
|
||||
// need those to add freezes safely. NOTE: We do not do this above, as
|
||||
// we may be able to freeze all the types up to where we found the
|
||||
// property, even if there are unknown types higher in the prototype
|
||||
// chain.
|
||||
while (curObj != foundProto) {
|
||||
if (curObj != foundProto) {
|
||||
types::TypeObject *typeObj = curObj->getType(cx);
|
||||
if (!typeObj)
|
||||
return false;
|
||||
@ -7685,11 +7700,13 @@ IonBuilder::TestCommonPropFunc(JSContext *cx, types::StackTypeSet *types, Handle
|
||||
// Even though we are not directly accessing the properties on the whole
|
||||
// prototype chain, we need to fault in the sets anyway, as we need
|
||||
// to freeze on them.
|
||||
types::HeapTypeSet *propSet = typeObj->getProperty(cx, types::IdToTypeId(id), false);
|
||||
types::HeapTypeSet *propSet =
|
||||
typeObj->getProperty(cx, types::IdToTypeId(id), false);
|
||||
if (!propSet)
|
||||
return false;
|
||||
if (propSet->ownProperty(false))
|
||||
return true;
|
||||
}
|
||||
|
||||
curObj = curObj->getProto();
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user