Backed out changeset 7e55ef1c49d1 (bug 1063598) for assertion failures

CLOSED TREE
This commit is contained in:
Phil Ringnalda 2014-09-06 22:40:45 -07:00
parent a9bf7d1159
commit bbc9b3e40a

View File

@ -1752,18 +1752,19 @@ HeapTypeSetKey::constant(CompilerConstraintList *constraints, Value *valOut)
if (nonData(constraints))
return false;
// Only singleton object properties can be marked as constants.
if (!object()->singleton())
if (!maybeTypes())
return false;
if (maybeTypes() && maybeTypes()->nonConstantProperty())
if (maybeTypes()->nonConstantProperty())
return false;
// Only singleton object properties can be marked as constants.
JS_ASSERT(object()->singleton());
// Get the current value of the property.
Shape *shape = object()->singleton()->nativeLookupPure(id());
if (!shape || !shape->hasDefaultGetter() || !shape->hasSlot() || shape->hadOverwrite())
if (!shape)
return false;
Value val = object()->singleton()->nativeGetSlot(shape->slot());
// If the value is a pointer to an object in the nursery, don't optimize.