Bug 1548044 - Handle unknownProperties as result of AutoSweepObjectGr…

…oup r=jandem,iain a=RyanVM Differential Revision: https://phabricator.services.mozilla.com/D29575 --HG-- extra : source : 153482073368465845666344d84ec51d5b404f5c extra : intermediate-source : a80f2fc253935a7e9bcf4d62cc146991fde58c6c
trman · Sep 24, 2019 · 80dea4c · 80dea4c
1 parent 198bb9d
commit 80dea4c
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 4 deletions.
diff --git a/js/src/vm/NativeObject.cpp b/js/src/vm/NativeObject.cpp
@@ -1236,9 +1236,8 @@ static MOZ_ALWAYS_INLINE void UpdateShapeTypeAndValueForWritableDataProp(
 
 void js::AddPropertyTypesAfterProtoChange(JSContext* cx, NativeObject* obj,
                                           ObjectGroup* oldGroup) {
-  AutoSweepObjectGroup sweepObjGroup(obj->group());
   MOZ_ASSERT(obj->group() != oldGroup);
-  MOZ_ASSERT(!obj->group()->unknownProperties(sweepObjGroup));
+  MOZ_ASSERT(!obj->group()->unknownPropertiesDontCheckGeneration());
 
   AutoSweepObjectGroup sweepOldGroup(oldGroup);
   if (oldGroup->unknownProperties(sweepOldGroup)) {

diff --git a/js/src/vm/TypeInference-inl.h b/js/src/vm/TypeInference-inl.h
@@ -1288,11 +1288,14 @@ inline HeapTypeSet* ObjectGroup::getProperty(const AutoSweepObjectGroup& sweep,
   MOZ_ASSERT(JSID_IS_VOID(id) || JSID_IS_EMPTY(id) || JSID_IS_STRING(id) ||
              JSID_IS_SYMBOL(id));
   MOZ_ASSERT_IF(!JSID_IS_EMPTY(id), id == IdToTypeId(id));
-  MOZ_ASSERT(!unknownProperties(sweep));
   MOZ_ASSERT_IF(obj, obj->group() == this);
   MOZ_ASSERT_IF(singleton(), obj);
   MOZ_ASSERT(cx->compartment() == compartment());
 
+  if (unknownProperties(sweep)) {
+    return nullptr;
+  }
+
   if (HeapTypeSet* types = maybeGetProperty(sweep, id)) {
     return types;
   }

diff --git a/js/src/vm/TypeInference.cpp b/js/src/vm/TypeInference.cpp
@@ -1300,6 +1300,9 @@ bool CompilerConstraintInstance<T>::generateTypeConstraint(
   }
 
   AutoSweepObjectGroup sweep(property.object()->maybeGroup());
+  if (property.object()->maybeGroup()->unknownProperties(sweep)) {
+    return false;
+  }
   if (!data.constraintHolds(sweep, cx, property, expected)) {
     return false;
   }
@@ -1356,7 +1359,9 @@ HeapTypeSetKey TypeSet::ObjectKey::property(jsid id) {
   property.id_ = id;
   if (ObjectGroup* group = maybeGroup()) {
     AutoSweepObjectGroup sweep(group);
-    property.maybeTypes_ = group->maybeGetProperty(sweep, id);
+    if (!group->unknownProperties(sweep)) {
+      property.maybeTypes_ = group->maybeGetProperty(sweep, id);
+    }
   }
 
   return property;