Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-30 05:35:31 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Compute correct object in BINDNAME IC, bug 727223. r=dvander

Browse Source
This commit is contained in:
Brian Hackett 2012-02-21 06:48:43 -08:00
parent cda86ec4ef
commit af46be0a37
1 changed files with 22 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
js/src/methodjit/PolyIC.cpp
View File

@ -1760,16 +1760,20 @@ class BindNameCompiler : public PICStubCompiler
BindNameLabels &labels = pic.bindNameLabels();
if (!IsCacheableNonGlobalScope(scopeChain))
return disable("non-cacheable obj at start of scope chain");
/* Guard on the shape of the scope chain. */
masm.loadPtr(Address(JSFrameReg, StackFrame::offsetOfScopeChain()), pic.objReg);
masm.loadShape(pic.objReg, pic.shapeReg);
Jump firstShape = masm.branchPtr(Assembler::NotEqual, pic.shapeReg,
ImmPtr(scopeChain->lastProperty()));
if (scopeChain != obj) {
/* Walk up the scope chain. */
JSObject *tobj = scopeChain;
JSObject *tobj = &scopeChain->asScope().enclosingScope();
Address parent(pic.objReg, ScopeObject::offsetOfEnclosingScope());
while (tobj && tobj != obj) {
while (tobj) {
if (!IsCacheableNonGlobalScope(tobj))
return disable("non-cacheable obj in scope chain");
masm.loadPayload(parent, pic.objReg);
@ -1778,10 +1782,13 @@ class BindNameCompiler : public PICStubCompiler
ImmPtr(tobj->lastProperty()));
if (!fails.append(shapeTest))
return error();
if (tobj == obj)
break;
tobj = &tobj->asScope().enclosingScope();
}
if (tobj != obj)
return disable("indirect hit");
}
Jump done = masm.jump();