wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 769195 - Fix an overzealous GuardShape in TestCommonPropFunc(). r=jandem

Browse Source
This commit is contained in:
Eric Faust 2012-06-28 03:27:05 -07:00
parent f21c28ed97
commit 7de7c41709
1 changed files with 4 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
js/src/ion/IonBuilder.cpp
View File

@ -4630,7 +4630,6 @@ IonBuilder::TestCommonPropFunc(JSContext *cx, types::TypeSet *types, HandleId id
{
JSObject *found = NULL;
JSObject *foundProto = NULL;
Shape *protoShape = NULL;
*funcp = NULL;
@ -4707,10 +4706,9 @@ IonBuilder::TestCommonPropFunc(JSContext *cx, types::TypeSet *types, HandleId id
// We only support cases with a single prototype shared. This is
// overwhelmingly more likely than having multiple different prototype
// chains with the same custom property function.
if (!foundProto) {
if (!foundProto)
foundProto = proto;
protoShape = shape;
} else if (foundProto != proto)
else if (foundProto != proto)
return true;
}
@ -4718,13 +4716,13 @@ IonBuilder::TestCommonPropFunc(JSContext *cx, types::TypeSet *types, HandleId id
if (!found)
return true;
JS_ASSERT(foundProto && protoShape);
JS_ASSERT(foundProto);
types->addFreeze(cx);
MInstruction *wrapper = MConstant::New(ObjectValue(*foundProto));
current->add(wrapper);
MGuardShape *guard = MGuardShape::New(wrapper, protoShape);
MGuardShape *guard = MGuardShape::New(wrapper, foundProto->lastProperty());
current->add(guard);
// Now we have to freeze all the property typesets to ensure there isn't a