Bug 1212183 - Fix DOM getter optimizations in the JITs.

js/src/jit/BaselineIC.cpp

@@ -4801,7 +4801,8 @@ UpdateExistingGetPropCallStubs(ICFallbackStub* fallbackStub,
                                HandleFunction getter)
 {
     MOZ_ASSERT(kind == ICStub::GetProp_CallScripted ||
-               kind == ICStub::GetProp_CallNative);
+               kind == ICStub::GetProp_CallNative ||
+               kind == ICStub::GetProp_CallNativeGlobal);
     MOZ_ASSERT(fallbackStub->isGetName_Fallback() ||
                fallbackStub->isGetProp_Fallback());
     MOZ_ASSERT(holder);
@@ -4822,7 +4823,9 @@ UpdateExistingGetPropCallStubs(ICFallbackStub* fallbackStub,
                     getPropStub->receiverGuard().update(receiverGuard);
 
                 MOZ_ASSERT(getPropStub->holderShape() != holder->lastProperty() ||
-                           !getPropStub->receiverGuard().matches(receiverGuard),
+                           !getPropStub->receiverGuard().matches(receiverGuard) ||
+                           getPropStub->toGetProp_CallNativeGlobal()->globalShape() !=
+                           receiver->as<ClonedBlockObject>().global().lastProperty(),
                            "Why didn't we end up using this stub?");
 
                 // We want to update the holder shape to match the new one no
@@ -4833,6 +4836,13 @@ UpdateExistingGetPropCallStubs(ICFallbackStub* fallbackStub,
                 // have changed which getter we want to use.
                 getPropStub->getter() = getter;
 
+                if (getPropStub->isGetProp_CallNativeGlobal()) {
+                    ICGetProp_CallNativeGlobal* globalStub =
+                        getPropStub->toGetProp_CallNativeGlobal();
+                    globalStub->globalShape() =
+                        receiver->as<ClonedBlockObject>().global().lastProperty();
+                }
+
                 if (getPropStub->receiverGuard().matches(receiverGuard))
                     foundMatchingStub = true;
             }
@@ -5006,8 +5016,8 @@ TryAttachGlobalNameAccessorStub(JSContext* cx, HandleScript script, jsbytecode*
         RootedFunction getter(cx, &shape->getterObject()->as<JSFunction>());
 
         JitSpew(JitSpew_BaselineIC, "  Generating GetName(GlobalName/NativeGetter) stub");
-        if (UpdateExistingGetPropCallStubs(stub, ICStub::GetProp_CallNative, current, global,
-                                           getter))
+        if (UpdateExistingGetPropCallStubs(stub, ICStub::GetProp_CallNativeGlobal, current,
+                                           globalLexical, getter))
         {
             *attached = true;
             return true;

js/src/jit/BaselineInspector.cpp

@@ -594,7 +594,16 @@ GlobalShapeForGetPropFunction(ICStub* stub)
             if (shape->getObjectClass()->flags & JSCLASS_IS_GLOBAL)
                 return shape;
         }
+    } else if (stub->isGetProp_CallNativeGlobal()) {
+        ICGetProp_CallNativeGlobal* nstub = stub->toGetProp_CallNativeGlobal();
+        if (nstub->isOwnGetter())
+            return nullptr;
+
+        Shape* shape = nstub->globalShape();
+        MOZ_ASSERT(shape->getObjectClass()->flags & JSCLASS_IS_GLOBAL);
+        return shape;
     }
+
     return nullptr;
 }
 
@@ -616,7 +625,8 @@ BaselineInspector::commonGetPropFunction(jsbytecode* pc, JSObject** holder, Shap
 
     for (ICStub* stub = entry.firstStub(); stub; stub = stub->next()) {
         if (stub->isGetProp_CallScripted() ||
-            stub->isGetProp_CallNative())
+            stub->isGetProp_CallNative() ||
+            stub->isGetProp_CallNativeGlobal())
         {
             ICGetPropCallGetter* nstub = static_cast<ICGetPropCallGetter*>(stub);
             bool isOwn = nstub->isOwnGetter();

js/src/jit/IonBuilder.cpp

@@ -8199,7 +8199,7 @@ IonBuilder::jsop_getgname(PropertyName* name)
     if (!getStaticName(obj, name, &emitted) || emitted)
         return emitted;
 
-    if (!forceInlineCaches()) {
+    if (!forceInlineCaches() && obj->is<GlobalObject>()) {
         TemporaryTypeSet* types = bytecodeTypes(pc);
         MDefinition* globalObj = constant(ObjectValue(*obj));
         if (!getPropTryCommonGetter(&emitted, globalObj, name, types) || emitted)