From 9c73373ad4b467517ca9293aa3c3c92c33418343 Mon Sep 17 00:00:00 2001 From: Brian Hackett Date: Fri, 1 Nov 2013 16:59:19 -0600 Subject: [PATCH] Bug 933734 - Check for undefined properties before emitting typed stores to global objects. --- js/src/jit/IonBuilder.cpp | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp index f888dbc2140d..ffe941e9ed53 100644 --- a/js/src/jit/IonBuilder.cpp +++ b/js/src/jit/IonBuilder.cpp @@ -6303,9 +6303,14 @@ IonBuilder::setStaticName(JSObject *staticObject, PropertyName *name) // If the property has a known type, we may be able to optimize typed stores by not // storing the type tag. MIRType slotType = MIRType_None; - JSValueType knownType = property.knownTypeTag(constraints()); - if (knownType != JSVAL_TYPE_UNKNOWN) - slotType = MIRTypeFromValueType(knownType); + { + Shape *shape = staticObject->nativeLookup(cx, id); + if (!shape || !shape->hasSlot() || !staticObject->getSlot(shape->slot()).isUndefined()) { + JSValueType knownType = property.knownTypeTag(constraints()); + if (knownType != JSVAL_TYPE_UNKNOWN) + slotType = MIRTypeFromValueType(knownType); + } + } bool needsBarrier = property.needsBarrier(constraints()); return storeSlot(obj, property.maybeTypes()->definiteSlot(), NumFixedSlots(staticObject),