From fed5b2af5234b6b08796017b3d5714e293a186a3 Mon Sep 17 00:00:00 2001 From: Jan de Mooij Date: Fri, 11 Oct 2013 20:24:33 +0200 Subject: [PATCH] Bug 925790 - Fix Octane/V8 SETPROP performance regression from bug 918584. r=shu --- js/src/jit/IonCaches.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/js/src/jit/IonCaches.cpp b/js/src/jit/IonCaches.cpp index 4c3e75d7b2d..a2f7a47c9bb 100644 --- a/js/src/jit/IonCaches.cpp +++ b/js/src/jit/IonCaches.cpp @@ -2731,8 +2731,10 @@ CanAttachNativeSetProp(HandleObject obj, HandleId id, ConstantOrRegister val, return SetPropertyIC::CanAttachNone; // If the object doesn't have the property, we don't know if we can attach - // a stub to add the property until we do the VM call to add. - if (!shape) + // a stub to add the property until we do the VM call to add. If the + // property exists as a data property on the prototype, we should add + // a new, shadowing property. + if (!shape || (obj != holder && shape->hasDefaultSetter() && shape->hasSlot())) return SetPropertyIC::MaybeCanAttachAddSlot; if (IsCacheableSetPropCallPropertyOp(obj, holder, shape) ||