From ffc54d673f25484180bcf261d7132da434505877 Mon Sep 17 00:00:00 2001 From: Shu-yu Guo Date: Fri, 9 Aug 2013 17:07:50 -0700 Subject: [PATCH] Bug 902722 - Guard typed arrays' shape instead of clasps in ICs. (r=jandem) --- js/src/jit/IonCaches.cpp | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/js/src/jit/IonCaches.cpp b/js/src/jit/IonCaches.cpp index e52f91535df..61c6ccce505 100644 --- a/js/src/jit/IonCaches.cpp +++ b/js/src/jit/IonCaches.cpp @@ -2311,14 +2311,13 @@ GenerateTypedArrayElement(JSContext *cx, MacroAssembler &masm, IonCache::StubAtt // The array type is the object within the table of typed array classes. int arrayType = tarr->type(); - Register tmpReg = output.scratchReg().gpr(); - JS_ASSERT(tmpReg != InvalidReg); - - // Check that the typed array is of the same type as the current object - // because load size differ in function of the typed array data width. - masm.branchTestObjClass(Assembler::NotEqual, object, tmpReg, tarr->getClass(), &failures); + // Guard on the shape. + Shape *shape = tarr->lastProperty(); + masm.branchTestObjShape(Assembler::NotEqual, object, shape, &failures); // Decide to what type index the stub should be optimized + Register tmpReg = output.scratchReg().gpr(); + JS_ASSERT(tmpReg != InvalidReg); Register indexReg = tmpReg; JS_ASSERT(!index.constant()); if (idval.isString()) {