Last Comment Bug 769195 - IonMonkey: TestCommonPropertyFunc() adds overzealous MGuardShape
: IonMonkey: TestCommonPropertyFunc() adds overzealous MGuardShape
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: x86 Mac OS X
: -- normal (vote)
: ---
Assigned To: Eric Faust [:efaust]
:
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-06-28 02:53 PDT by Eric Faust [:efaust]
Modified: 2012-06-28 03:29 PDT (History)
1 user (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Fix (1.89 KB, patch)
2012-06-28 03:06 PDT, Eric Faust [:efaust]
jdemooij: review+
Details | Diff | Splinter Review

Description Eric Faust [:efaust] 2012-06-28 02:53:17 PDT
TestCommonPropertyFunc() keeps track of the shape * that the property was actually found on, and guards on that. This is overzealous. The property is almost certainly not the last one added, so this will bailout more often than necessary.
Comment 1 Eric Faust [:efaust] 2012-06-28 03:06:01 PDT
Created attachment 637434 [details] [diff] [review]
Fix
Comment 2 Jan de Mooij [:jandem] 2012-06-28 03:13:39 PDT
Comment on attachment 637434 [details] [diff] [review]
Fix

Review of attachment 637434 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/IonBuilder.cpp
@@ +4711,2 @@
>          } else if (foundProto != proto)
>              return true;

Nit: single-line "if" now so no longer needs braces.
Comment 3 Eric Faust [:efaust] 2012-06-28 03:29:18 PDT
https://hg.mozilla.org/projects/ionmonkey/rev/4f57f42dc238

Changed from guarding on the shape we found the property on to the shape of the object.

Note You need to log in before you can comment on or make changes to this bug.