Closed Bug 769195 Opened 12 years ago Closed 12 years ago

IonMonkey: TestCommonPropertyFunc() adds overzealous MGuardShape

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: efaust, Assigned: efaust)

Details

Attachments

(1 file)

TestCommonPropertyFunc() keeps track of the shape * that the property was actually found on, and guards on that. This is overzealous. The property is almost certainly not the last one added, so this will bailout more often than necessary.
Attached patch FixSplinter Review
Attachment #637434 - Flags: review?(jdemooij)
Comment on attachment 637434 [details] [diff] [review]
Fix

Review of attachment 637434 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/IonBuilder.cpp
@@ +4711,2 @@
>          } else if (foundProto != proto)
>              return true;

Nit: single-line "if" now so no longer needs braces.
Attachment #637434 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/projects/ionmonkey/rev/4f57f42dc238

Changed from guarding on the shape we found the property on to the shape of the object.
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.