From 7c42464249e7b618c10fc498c1ebd88470618e0a Mon Sep 17 00:00:00 2001 From: Roy Tam Date: Mon, 25 Mar 2019 22:08:42 +0800 Subject: [PATCH] ported change from tenfourfox: - chemspill: M1537924 M1538006 (backported to ESR45) (b22dfbd77) --- js/src/jit/MIR.cpp | 9 +++++++-- js/src/jit/MIR.h | 4 ---- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp index 287b875824..d46ce801bb 100644 --- a/js/src/jit/MIR.cpp +++ b/js/src/jit/MIR.cpp @@ -6556,8 +6556,10 @@ jit::PropertyWriteNeedsTypeBarrier(TempAllocator& alloc, CompilerConstraintList* bool success = true; for (size_t i = 0; i < types->getObjectCount(); i++) { TypeSet::ObjectKey* key = types->getObject(i); - if (!key || key->unknownProperties()) + if (!key) continue; + if (!key->hasStableClassAndProto(constraints)) + return true; // TI doesn't track TypedArray indexes and should never insert a type // barrier for them. @@ -6609,8 +6611,11 @@ jit::PropertyWriteNeedsTypeBarrier(TempAllocator& alloc, CompilerConstraintList* TypeSet::ObjectKey* excluded = nullptr; for (size_t i = 0; i < types->getObjectCount(); i++) { TypeSet::ObjectKey* key = types->getObject(i); - if (!key || key->unknownProperties()) + if (!key) continue; + if (!key->hasStableClassAndProto(constraints)) + return true; + if (!name && IsTypedArrayClass(key->clasp())) continue; diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h index b2e84322f9..21243b2527 100644 --- a/js/src/jit/MIR.h +++ b/js/src/jit/MIR.h @@ -9910,10 +9910,6 @@ class MArraySlice return unboxedType_; } - AliasSet getAliasSet() const override { - return AliasSet::Store(AliasSet::BoxedOrUnboxedElements(unboxedType()) | - AliasSet::ObjectFields); - } bool possiblyCalls() const override { return true; }