Bug 1538006 - Don't emit unbarriered writes to an object if its group…

… might change. r=tcampbell, a=dveditz

Differential Revision: https://phabricator.services.mozilla.com/D24448

--HG--
extra : source : 2c49e736571bdcf4d8897eab3c3ad6d4a079f664
extra : intermediate-source : 77536919b1210dcee2e3d72416108210bd9a10c8

js/src/jit/MIR.cpp

@@ -6290,10 +6290,14 @@ bool jit::PropertyWriteNeedsTypeBarrier(TempAllocator& alloc,
   bool success = true;
   for (size_t i = 0; i < types->getObjectCount(); i++) {
     TypeSet::ObjectKey* key = types->getObject(i);
-    if (!key || key->unknownProperties()) {
+    if (!key) {
       continue;
     }
 
+    if (!key->hasStableClassAndProto(constraints)) {
+      return true;
+    }
+
     // TI doesn't track TypedArray indexes and should never insert a type
     // barrier for them.
     if (!name && IsTypedArrayClass(key->clasp())) {
@@ -6350,9 +6354,14 @@ bool jit::PropertyWriteNeedsTypeBarrier(TempAllocator& alloc,
   TypeSet::ObjectKey* excluded = nullptr;
   for (size_t i = 0; i < types->getObjectCount(); i++) {
     TypeSet::ObjectKey* key = types->getObject(i);
-    if (!key || key->unknownProperties()) {
+    if (!key) {
       continue;
     }
+
+    if (!key->hasStableClassAndProto(constraints)) {
+      return true;
+    }
+
     if (!name && IsTypedArrayClass(key->clasp())) {
       continue;
     }