Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-09 19:35:51 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1283334 - Part 4: Do not sparsify dense arrays when freezing - Ion Caches. r=nbp

Browse Source 
--HG--
extra : rebase_source : 8ef190fde5dab1fe3ed072366259338ca3bc6650
This commit is contained in:
Leo Gaspard 2016-08-24 16:32:27 -07:00
parent 83654bf8c5
commit 67d76bf3ba
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
js/src/jit/IonCaches.cpp
View File

@ -3599,6 +3599,10 @@ SetPropertyIC::tryAttachStub(JSContext* cx, HandleScript outerScript, IonScript*
if (!canAttachStub() || obj->watched())
return true;
// Fail cache emission if the object is frozen
if (obj->is<NativeObject>() && obj->as<NativeObject>().getElementsHeader()->isFrozen())
return true;
bool nameOrSymbol;
if (!ValueToNameOrSymbolId(cx, idval, id, &nameOrSymbol))
return false;
@ -3643,6 +3647,10 @@ SetPropertyIC::tryAttachAddSlot(JSContext* cx, HandleScript outerScript, IonScri
if (!JSID_IS_STRING(id) && !JSID_IS_SYMBOL(id))
return true;
// Fail cache emission if the object is frozen
if (obj->is<NativeObject>() && obj->as<NativeObject>().getElementsHeader()->isFrozen())
return true;
// A GC may have caused cache.value() to become stale as it is not traced.
// In this case the IonScript will have been invalidated, so check for that.
// Assert no further GC is possible past this point.