diff --git a/js/src/jit/IonAnalysis.cpp b/js/src/jit/IonAnalysis.cpp index f6ad33c1d84..999c38c2eae 100644 --- a/js/src/jit/IonAnalysis.cpp +++ b/js/src/jit/IonAnalysis.cpp @@ -1576,11 +1576,16 @@ TryEliminateTypeBarrierFromTest(MTypeBarrier *barrier, bool filtersNull, bool fi // Disregard the possible unbox added before the Typebarrier for checking. MDefinition *input = barrier->input(); - if (input->isUnbox() && input->toUnbox()->mode() != MUnbox::Fallible) - input = input->toUnbox()->input(); + MUnbox *inputUnbox = nullptr; + if (input->isUnbox() && input->toUnbox()->mode() != MUnbox::Fallible) { + inputUnbox = input->toUnbox(); + input = inputUnbox->input(); + } if (test->getOperand(0) == input && direction == TRUE_BRANCH) { *eliminated = true; + if (inputUnbox) + inputUnbox->makeInfallible(); barrier->replaceAllUsesWith(barrier->input()); return; } @@ -1614,6 +1619,8 @@ TryEliminateTypeBarrierFromTest(MTypeBarrier *barrier, bool filtersNull, bool fi } *eliminated = true; + if (inputUnbox) + inputUnbox->makeInfallible(); barrier->replaceAllUsesWith(barrier->input()); } diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h index 849a6571620..25b8ca986bb 100644 --- a/js/src/jit/MIR.h +++ b/js/src/jit/MIR.h @@ -2373,6 +2373,11 @@ class MUnbox : public MUnaryInstruction, public BoxInputsPolicy return AliasSet::None(); } void printOpcode(FILE *fp) const; + void makeInfallible() { + // Should only be called if we're already Infallible or TypeBarrier + JS_ASSERT(mode() != Fallible); + mode_ = Infallible; + } }; class MGuardObject : public MUnaryInstruction, public SingleObjectPolicy