mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-10-08 19:04:45 +00:00
Bug 1174712 - Tolerate singleton objects with uncacheable prototypes in Ion caches, r=jandem.
This commit is contained in:
parent
90ee9d633a
commit
abdda6fd96
@ -424,10 +424,16 @@ GeneratePrototypeGuards(JSContext* cx, IonScript* ion, MacroAssembler& masm, JSO
|
||||
return;
|
||||
while (pobj != holder) {
|
||||
if (pobj->hasUncacheableProto()) {
|
||||
MOZ_ASSERT(!pobj->isSingleton());
|
||||
masm.movePtr(ImmGCPtr(pobj), scratchReg);
|
||||
Address groupAddr(scratchReg, JSObject::offsetOfGroup());
|
||||
masm.branchPtr(Assembler::NotEqual, groupAddr, ImmGCPtr(pobj->group()), failures);
|
||||
if (pobj->isSingleton()) {
|
||||
// Singletons can have their group's |proto| mutated directly.
|
||||
masm.loadPtr(groupAddr, scratchReg);
|
||||
Address protoAddr(scratchReg, ObjectGroup::offsetOfProto());
|
||||
masm.branchPtr(Assembler::NotEqual, protoAddr, ImmGCPtr(pobj->getProto()), failures);
|
||||
} else {
|
||||
masm.branchPtr(Assembler::NotEqual, groupAddr, ImmGCPtr(pobj->group()), failures);
|
||||
}
|
||||
}
|
||||
pobj = pobj->getProto();
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user