Backed out changeset c2ba0e6f13b4 (bug 1153057) for spidermonkey bustage CLOSED TREE

js/src/frontend/BytecodeEmitter.cpp

@@ -6755,7 +6755,7 @@ BytecodeEmitter::emitPropertyList(ParseNode* pn, MutableHandlePlainObject objp,
             propdef->pn_right->pn_funbox->needsHomeObject())
         {
             MOZ_ASSERT(propdef->pn_right->pn_funbox->function()->isMethod());
-            if (!emit2(JSOP_INITHOMEOBJECT, isIndex))
+            if (!emit1(JSOP_INITHOMEOBJECT))
                 return false;
         }
 
@@ -7112,7 +7112,7 @@ BytecodeEmitter::emitClass(ParseNode* pn)
         return false;
 
     if (constructor->pn_funbox->needsHomeObject()) {
-        if (!emit2(JSOP_INITHOMEOBJECT, 0))
+        if (!emit1(JSOP_INITHOMEOBJECT))
             return false;
     }
 

js/src/jit-test/tests/basic/bug1153057.js

@@ -1 +0,0 @@
-({ "0"() { eval(); } });

js/src/tests/ecma_6/Class/superPropHomeObject.js

@@ -1,3 +1,4 @@
+print("foo");
 var test = `
 
 // This is super weird. A super property reference in the spec contains two
@@ -17,12 +18,10 @@ class derived extends base {
     constructor() { }
     test(expected) { super.test(expected); }
     testArrow() { return (() => super.test(this)); }
-    ["testCPN"](expected) { super.test(expected); }
 }
 
 let derivedInstance = new derived();
 derivedInstance.test(derivedInstance);
-derivedInstance.testCPN(derivedInstance);
 
 let obj = { test: derivedInstance.test };
 obj.test(obj);

js/src/vm/Interpreter.cpp

@@ -3970,8 +3970,7 @@ END_CASE(JSOP_OBJWITHPROTO)
 
 CASE(JSOP_INITHOMEOBJECT)
 {
-    uint8_t skipOver = GET_UINT8(REGS.pc);
-    MOZ_ASSERT(REGS.stackDepth() >= 2 + skipOver);
+    MOZ_ASSERT(REGS.stackDepth() >= 2);
 
     /* Load the function to be initialized */
     RootedFunction& func = rootFunction0;
@@ -3980,7 +3979,7 @@ CASE(JSOP_INITHOMEOBJECT)
 
     /* Load the home object */
     RootedNativeObject& obj = rootNativeObject0;
-    obj = &REGS.sp[-2 - skipOver].toObject().as<NativeObject>();
+    obj = &REGS.sp[-2].toObject().as<NativeObject>();
     MOZ_ASSERT(obj->is<PlainObject>() || obj->is<JSFunction>());
 
     func->setExtendedSlot(FunctionExtended::METHOD_HOMEOBJECT_SLOT, ObjectValue(*obj));

js/src/vm/Opcodes.h

@@ -870,10 +870,10 @@
      * the set, and leaves both on the stack.
      *   Category: Literals
      *   Type: Object
-     *   Operands: uint8_t n
-     *   Stack: homeObject, [...n], fun => homeObject, [...n], fun
+     *   Operands:
+     *   Stack: homeObject, fun => homeObject, fun
      */\
-    macro(JSOP_INITHOMEOBJECT,  92, "inithomeobject",   NULL,         2,  2,  2, JOF_UINT8) \
+    macro(JSOP_INITHOMEOBJECT,  92, "inithomeobject",   NULL,         1,  2,  2, JOF_BYTE|JOF_SET|JOF_DETECTING) \
     \
     /*
      * Initialize a named property in an object literal, like '{a: x}'.