diff --git a/js/src/builtin/TypedObject.h b/js/src/builtin/TypedObject.h index ec902b22612..02af9c11769 100644 --- a/js/src/builtin/TypedObject.h +++ b/js/src/builtin/TypedObject.h @@ -1071,6 +1071,19 @@ IsTypedObjectClass(const Class *class_) class_ == &InlineOpaqueTypedObject::class_; } +inline bool +IsOpaqueTypedObjectClass(const Class *class_) +{ + return class_ == &OutlineOpaqueTypedObject::class_ || + class_ == &InlineOpaqueTypedObject::class_; +} + +inline const Class * +GetOutlineTypedObjectClass(bool opaque) +{ + return opaque ? &OutlineOpaqueTypedObject::class_ : &OutlineTransparentTypedObject::class_; +} + inline bool IsSimpleTypeDescrClass(const Class* clasp) { @@ -1103,7 +1116,7 @@ IsTypeDescrClass(const Class* clasp) inline bool TypedObject::opaque() const { - return is() || is(); + return IsOpaqueTypedObjectClass(getClass()); } // Inline transparent typed objects do not initially have an array buffer, but diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp index 74d379a2632..ac3dbc73230 100644 --- a/js/src/jit/IonBuilder.cpp +++ b/js/src/jit/IonBuilder.cpp @@ -7411,13 +7411,17 @@ IonBuilder::pushDerivedTypedObject(bool *emitted, current->add(derivedTypedObj); current->push(derivedTypedObj); - // Determine (if possible) the class/proto that `derivedTypedObj` - // will have. For derived typed objects, the class (transparent vs - // opaque) will be the same as the incoming object from which the - // derived typed object is, well, derived. The prototype will be - // determined based on the type descriptor (and is immutable). + // Determine (if possible) the class/proto that `derivedTypedObj` will + // have. For derived typed objects, the opacity will be the same as the + // incoming object from which the derived typed object is, well, derived. + // The prototype will be determined based on the type descriptor (and is + // immutable). types::TemporaryTypeSet *objTypes = obj->resultTypeSet(); - const Class *expectedClass = objTypes ? objTypes->getKnownClass() : nullptr; + const Class *expectedClass = nullptr; + if (const Class *objClass = objTypes ? objTypes->getKnownClass() : nullptr) { + MOZ_ASSERT(IsTypedObjectClass(objClass)); + expectedClass = GetOutlineTypedObjectClass(IsOpaqueTypedObjectClass(objClass)); + } const TypedProto *expectedProto = derivedPrediction.getKnownPrototype(); MOZ_ASSERT_IF(expectedClass, IsTypedObjectClass(expectedClass));