Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-26 06:11:37 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 952321 - Don't add proxy stubs in unbarriered GetPropertyICs. (r=jandem)

Browse Source
This commit is contained in:
Eric Faust 2014-02-14 11:41:44 -08:00
parent a3e3ddb291
commit 54f47748b6
1 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
js/src/jit/IonCaches.cpp
View File

@ -1363,8 +1363,10 @@ GetPropertyIC::tryAttachDOMProxyShadowed(JSContext *cx, IonScript *ion,
JS_ASSERT(canAttachStub());
JS_ASSERT(!*emitted);
JS_ASSERT(IsCacheableDOMProxy(obj));
JS_ASSERT(monitoredResult());
JS_ASSERT(output().hasValue());
if (idempotent() || !output().hasValue())
if (idempotent())
return true;
*emitted = true;
@ -1407,6 +1409,8 @@ GetPropertyIC::tryAttachDOMProxyUnshadowed(JSContext *cx, IonScript *ion, Handle
JS_ASSERT(canAttachStub());
JS_ASSERT(!*emitted);
JS_ASSERT(IsCacheableDOMProxy(obj));
JS_ASSERT(monitoredResult());
JS_ASSERT(output().hasValue());
RootedObject checkObj(cx, obj->getTaggedProto().toObjectOrNull());
RootedObject holder(cx);
@ -1421,7 +1425,7 @@ GetPropertyIC::tryAttachDOMProxyUnshadowed(JSContext *cx, IonScript *ion, Handle
return true;
// Make sure we observe our invariants if we're gonna deoptimize.
if (!holder && (idempotent() || !output().hasValue()))
if (!holder && idempotent())
return true;
*emitted = true;
@ -1508,6 +1512,11 @@ GetPropertyIC::tryAttachProxy(JSContext *cx, IonScript *ion, HandleObject obj,
if (!obj->is<ProxyObject>())
return true;
// TI can't be sure about our properties, so make sure anything
// we return can be monitored directly.
if (!monitoredResult())
return true;
// Skim off DOM proxies.
if (IsCacheableDOMProxy(obj)) {
RootedId id(cx, NameToId(name));
@ -1542,11 +1551,13 @@ GetPropertyIC::tryAttachGenericProxy(JSContext *cx, IonScript *ion, HandleObject
JS_ASSERT(canAttachStub());
JS_ASSERT(!*emitted);
JS_ASSERT(obj->is<ProxyObject>());
JS_ASSERT(monitoredResult());
JS_ASSERT(output().hasValue());
if (hasGenericProxyStub())
return true;
if (idempotent() || !output().hasValue())
if (idempotent())
return true;
*emitted = true;