Last Comment Bug 769195 - IonMonkey: TestCommonPropertyFunc() adds overzealous MGuardShape
: IonMonkey: TestCommonPropertyFunc() adds overzealous MGuardShape
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: x86 Mac OS X
: -- normal (vote)
: ---
Assigned To: Eric Faust [:efaust]
: Jason Orendorff [:jorendorff]
Depends on:
  Show dependency treegraph
Reported: 2012-06-28 02:53 PDT by Eric Faust [:efaust]
Modified: 2012-06-28 03:29 PDT (History)
1 user (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Fix (1.89 KB, patch)
2012-06-28 03:06 PDT, Eric Faust [:efaust]
jdemooij: review+
Details | Diff | Splinter Review

Description Eric Faust [:efaust] 2012-06-28 02:53:17 PDT
TestCommonPropertyFunc() keeps track of the shape * that the property was actually found on, and guards on that. This is overzealous. The property is almost certainly not the last one added, so this will bailout more often than necessary.
Comment 1 Eric Faust [:efaust] 2012-06-28 03:06:01 PDT
Created attachment 637434 [details] [diff] [review]
Comment 2 Jan de Mooij [:jandem] 2012-06-28 03:13:39 PDT
Comment on attachment 637434 [details] [diff] [review]

Review of attachment 637434 [details] [diff] [review]:

::: js/src/ion/IonBuilder.cpp
@@ +4711,2 @@
>          } else if (foundProto != proto)
>              return true;

Nit: single-line "if" now so no longer needs braces.
Comment 3 Eric Faust [:efaust] 2012-06-28 03:29:18 PDT

Changed from guarding on the shape we found the property on to the shape of the object.

Note You need to log in before you can comment on or make changes to this bug.