diff --git a/js/src/builtins.tbl b/js/src/builtins.tbl index 34480189f8fa..2d371d258602 100644 --- a/js/src/builtins.tbl +++ b/js/src/builtins.tbl @@ -79,6 +79,7 @@ BUILTIN2(extern, DOUBLE, js_StringToNumber, CONTEXT, STRING, BUILTIN2(extern, INT32, js_StringToInt32, CONTEXT, STRING, 1, 1) BUILTIN2(FRIEND, BOOL, js_CloseIterator, CONTEXT, JSVAL, 0, 0) BUILTIN2(extern, SIDEEXIT, js_CallTree, INTERPSTATE, FRAGMENT, 0, 0) +BUILTIN2(extern, OBJECT, js_FastNewObject, CONTEXT, OBJECT, 0, 0) BUILTIN3(extern, BOOL, js_AddProperty, CONTEXT, OBJECT, SCOPEPROP, 0, 0) BUILTIN3(extern, BOOL, js_HasNamedProperty, CONTEXT, OBJECT, STRING, 0, 0) BUILTIN3(extern, BOOL, js_HasNamedPropertyInt32, CONTEXT, OBJECT, INT32, 0, 0) diff --git a/js/src/jsbuiltins.cpp b/js/src/jsbuiltins.cpp index dce939b38cd5..a69df216725c 100644 --- a/js/src/jsbuiltins.cpp +++ b/js/src/jsbuiltins.cpp @@ -221,6 +221,52 @@ js_CallTree(InterpState* state, Fragment* f) return lr; } +JSObject* FASTCALL +js_FastNewObject(JSContext* cx, JSObject* ctor) +{ + JS_ASSERT(HAS_FUNCTION_CLASS(ctor)); + JSFunction* fun = GET_FUNCTION_PRIVATE(cx, ctor); + JSClass* clasp = (FUN_INTERPRETED(fun) || (fun->flags & JSFUN_TRACEABLE)) + ? &js_ObjectClass + : FUN_CLASP(fun); + JS_ASSERT(clasp != &js_ArrayClass); + + JS_LOCK_OBJ(cx, ctor); + JSScope *scope = OBJ_SCOPE(ctor); + JS_ASSERT(scope->object == ctor); + JSAtom* atom = cx->runtime->atomState.classPrototypeAtom; + + JSScopeProperty *sprop = SCOPE_GET_PROPERTY(scope, ATOM_TO_JSID(atom)); + JS_ASSERT(SPROP_HAS_VALID_SLOT(sprop, scope)); + jsval v = LOCKED_OBJ_GET_SLOT(ctor, sprop->slot); + JS_UNLOCK_SCOPE(cx, scope); + + JSObject* proto; + if (JSVAL_IS_PRIMITIVE(v)) { + if (!js_GetClassPrototype(cx, JSVAL_TO_OBJECT(ctor->fslots[JSSLOT_PARENT]), + INT_TO_JSID(JSProto_Object), &proto)) { + return NULL; + } + } else { + proto = JSVAL_TO_OBJECT(v); + } + + JS_ASSERT(JS_ON_TRACE(cx)); + JSObject* obj = (JSObject*) js_NewGCThing(cx, GCX_OBJECT, sizeof(JSObject)); + if (!obj) + return NULL; + + obj->classword = jsuword(clasp); + obj->fslots[JSSLOT_PROTO] = OBJECT_TO_JSVAL(proto); + obj->fslots[JSSLOT_PARENT] = ctor->fslots[JSSLOT_PARENT]; + for (unsigned i = JSSLOT_PRIVATE; i != JS_INITIAL_NSLOTS; ++i) + obj->fslots[i] = JSVAL_VOID; + + obj->map = js_HoldObjectMap(cx, proto->map); + obj->dslots = NULL; + return obj; +} + JSBool FASTCALL js_AddProperty(JSContext* cx, JSObject* obj, JSScopeProperty* sprop) { diff --git a/js/src/jsbuiltins.h b/js/src/jsbuiltins.h index 532ffd71a45c..4dd94d8d814e 100644 --- a/js/src/jsbuiltins.h +++ b/js/src/jsbuiltins.h @@ -50,8 +50,7 @@ #endif enum JSTNErrType { INFALLIBLE, FAIL_STATUS, FAIL_NULL, FAIL_NEG, FAIL_VOID, FAIL_COOKIE }; -enum { JSTN_ERRTYPE_MASK = 0x07, JSTN_UNBOX_AFTER = 0x08, JSTN_MORE = 0x10, - JSTN_CONSTRUCTOR = 0x20 }; +enum { JSTN_ERRTYPE_MASK = 0x07, JSTN_UNBOX_AFTER = 0x08, JSTN_MORE = 0x10 }; #define JSTN_ERRTYPE(jstn) ((jstn)->flags & JSTN_ERRTYPE_MASK) @@ -86,8 +85,7 @@ struct JSTraceableNative { const nanojit::CallInfo *builtin; const char *prefix; const char *argtypes; - uintN flags; /* JSTNErrType | JSTN_UNBOX_AFTER | JSTN_MORE | - JSTN_CONSTRUCTOR */ + uintN flags; /* JSTNErrType | JSTN_UNBOX_AFTER | JSTN_MORE */ }; /* @@ -179,8 +177,6 @@ struct JSTraceableNative { #define _JS_CTYPE_THIS _JS_CTYPE(JSObject *, _JS_PTR,"T", "", INFALLIBLE) #define _JS_CTYPE_THIS_DOUBLE _JS_CTYPE(jsdouble, _JS_F64,"D", "", INFALLIBLE) #define _JS_CTYPE_THIS_STRING _JS_CTYPE(JSString *, _JS_PTR,"S", "", INFALLIBLE) -#define _JS_CTYPE_CALLEE _JS_CTYPE(JSObject *, _JS_PTR,"f","", INFALLIBLE) -#define _JS_CTYPE_CALLEE_PROTO _JS_CTYPE(JSObject *, _JS_PTR,"p","", INFALLIBLE) #define _JS_CTYPE_PC _JS_CTYPE(jsbytecode *, _JS_PTR,"P", "", INFALLIBLE) #define _JS_CTYPE_JSVAL _JS_JSVAL_CTYPE( _JS_PTR, "","v", INFALLIBLE) #define _JS_CTYPE_JSVAL_RETRY _JS_JSVAL_CTYPE( _JS_PTR, --, --, FAIL_COOKIE) @@ -196,10 +192,8 @@ struct JSTraceableNative { #define _JS_CTYPE_STRING_RETRY _JS_CTYPE(JSString *, _JS_PTR, --, --, FAIL_NULL) #define _JS_CTYPE_STRING_FAIL _JS_CTYPE(JSString *, _JS_PTR, --, --, FAIL_STATUS) #define _JS_CTYPE_OBJECT _JS_CTYPE(JSObject *, _JS_PTR, "","o", INFALLIBLE) -#define _JS_CTYPE_OBJECT_RETRY _JS_CTYPE(JSObject *, _JS_PTR, --, --, FAIL_NULL) +#define _JS_CTYPE_OBJECT_RETRY_NULL _JS_CTYPE(JSObject *, _JS_PTR, --, --, FAIL_NULL) #define _JS_CTYPE_OBJECT_FAIL _JS_CTYPE(JSObject *, _JS_PTR, --, --, FAIL_STATUS) -#define _JS_CTYPE_CONSTRUCTOR_RETRY _JS_CTYPE(JSObject *, _JS_PTR, --, --, FAIL_NULL | \ - JSTN_CONSTRUCTOR) #define _JS_CTYPE_REGEXP _JS_CTYPE(JSObject *, _JS_PTR, "","r", INFALLIBLE) #define _JS_CTYPE_SCOPEPROP _JS_CTYPE(JSScopeProperty *, _JS_PTR, --, --, INFALLIBLE) #define _JS_CTYPE_SIDEEXIT _JS_CTYPE(SideExit *, _JS_PTR, --, --, INFALLIBLE) @@ -321,15 +315,15 @@ struct JSTraceableNative { #define JS_DEFINE_TRCINFO_1(name, tn0) \ _JS_DEFINE_CALLINFO_n tn0 \ JSTraceableNative name##_trcinfo[] = { \ - { (JSFastNative)name, _JS_TN_INIT_HELPER_n tn0 } \ + { name, _JS_TN_INIT_HELPER_n tn0 } \ }; #define JS_DEFINE_TRCINFO_2(name, tn0, tn1) \ _JS_DEFINE_CALLINFO_n tn0 \ _JS_DEFINE_CALLINFO_n tn1 \ JSTraceableNative name##_trcinfo[] = { \ - { (JSFastNative)name, _JS_TN_INIT_HELPER_n tn0 | JSTN_MORE }, \ - { (JSFastNative)name, _JS_TN_INIT_HELPER_n tn1 } \ + { name, _JS_TN_INIT_HELPER_n tn0 | JSTN_MORE }, \ + { name, _JS_TN_INIT_HELPER_n tn1 } \ }; #define JS_DEFINE_TRCINFO_3(name, tn0, tn1, tn2) \ @@ -337,9 +331,9 @@ struct JSTraceableNative { _JS_DEFINE_CALLINFO_n tn1 \ _JS_DEFINE_CALLINFO_n tn2 \ JSTraceableNative name##_trcinfo[] = { \ - { (JSFastNative)name, _JS_TN_INIT_HELPER_n tn0 | JSTN_MORE }, \ - { (JSFastNative)name, _JS_TN_INIT_HELPER_n tn1 | JSTN_MORE }, \ - { (JSFastNative)name, _JS_TN_INIT_HELPER_n tn2 } \ + { name, _JS_TN_INIT_HELPER_n tn0 | JSTN_MORE }, \ + { name, _JS_TN_INIT_HELPER_n tn1 | JSTN_MORE }, \ + { name, _JS_TN_INIT_HELPER_n tn2 } \ }; #define JS_DEFINE_TRCINFO_4(name, tn0, tn1, tn2, tn3) \ @@ -348,10 +342,10 @@ struct JSTraceableNative { _JS_DEFINE_CALLINFO_n tn2 \ _JS_DEFINE_CALLINFO_n tn3 \ JSTraceableNative name##_trcinfo[] = { \ - { (JSFastNative)name, _JS_TN_INIT_HELPER_n tn0 | JSTN_MORE }, \ - { (JSFastNative)name, _JS_TN_INIT_HELPER_n tn1 | JSTN_MORE }, \ - { (JSFastNative)name, _JS_TN_INIT_HELPER_n tn2 | JSTN_MORE }, \ - { (JSFastNative)name, _JS_TN_INIT_HELPER_n tn3 } \ + { name, _JS_TN_INIT_HELPER_n tn0 | JSTN_MORE }, \ + { name, _JS_TN_INIT_HELPER_n tn1 | JSTN_MORE }, \ + { name, _JS_TN_INIT_HELPER_n tn2 | JSTN_MORE }, \ + { name, _JS_TN_INIT_HELPER_n tn3 } \ }; #define _JS_DEFINE_CALLINFO_n(n, args) JS_DEFINE_CALLINFO_##n args @@ -390,28 +384,28 @@ js_Int32ToId(JSContext* cx, int32 index, jsid* id) #endif /* !JS_TRACER */ -/* Defined in jsobj.cpp. */ -JS_DECLARE_CALLINFO(js_Object_tn) - -/* Defined in jsarray.cpp. */ +/* Defined in jsarray.cpp */ +JS_DECLARE_CALLINFO(js_Array_dense_setelem) JS_DECLARE_CALLINFO(js_FastNewArray) -JS_DECLARE_CALLINFO(js_FastNewArrayWithLength) JS_DECLARE_CALLINFO(js_NewUninitializedArray) +JS_DECLARE_CALLINFO(js_FastNewArrayWithLength) JS_DECLARE_CALLINFO(js_Array_1str) JS_DECLARE_CALLINFO(js_ArrayCompPush) -JS_DECLARE_CALLINFO(js_Array_dense_setelem) -/* Defined in jsnum.cpp. */ +/* Defined in jsdate.cpp */ +JS_DECLARE_CALLINFO(js_FastNewDate) + +/* Defined in jsnum.cpp */ JS_DECLARE_CALLINFO(js_NumberToString) -/* Defined in jsstr.cpp. */ +/* Defined in jsstr.cpp */ JS_DECLARE_CALLINFO(js_ConcatStrings) JS_DECLARE_CALLINFO(js_String_getelem) JS_DECLARE_CALLINFO(js_String_p_charCodeAt) JS_DECLARE_CALLINFO(js_EqualStrings) JS_DECLARE_CALLINFO(js_CompareStrings) -/* Defined in jsbuiltins.cpp. */ +/* Defined in jsbuiltins.cpp */ #define BUILTIN1(linkage, rt, op, at0, cse, fold) JS_DECLARE_CALLINFO(op) #define BUILTIN2(linkage, rt, op, at0, at1, cse, fold) JS_DECLARE_CALLINFO(op) #define BUILTIN3(linkage, rt, op, at0, at1, at2, cse, fold) JS_DECLARE_CALLINFO(op) diff --git a/js/src/jsdate.cpp b/js/src/jsdate.cpp index 6adb31844494..e34986e47533 100644 --- a/js/src/jsdate.cpp +++ b/js/src/jsdate.cpp @@ -2022,6 +2022,8 @@ date_valueOf(JSContext *cx, uintN argc, jsval *vp) return date_toString(cx, argc, vp); } +JS_DEFINE_CALLINFO_2(extern, OBJECT, js_FastNewDate, CONTEXT, OBJECT, 0, 0) + // Don't really need an argument here, but we don't support arg-less builtins JS_DEFINE_TRCINFO_1(date_now, (1, (static, DOUBLE, date_now_tn, CONTEXT, 0, 0))) @@ -2170,8 +2172,8 @@ JS_STATIC_ASSERT(JSSLOT_PRIVATE == JSSLOT_UTC_TIME); JS_STATIC_ASSERT(JSSLOT_UTC_TIME + 1 == JSSLOT_LOCAL_TIME); #ifdef JS_TRACER -static JSObject* FASTCALL -Date_tn(JSContext* cx, JSObject* proto) +JSObject* FASTCALL +js_FastNewDate(JSContext* cx, JSObject* proto) { JS_ASSERT(JS_ON_TRACE(cx)); JSObject* obj = (JSObject*) js_NewGCThing(cx, GCX_OBJECT, sizeof(JSObject)); @@ -2199,10 +2201,6 @@ Date_tn(JSContext* cx, JSObject* proto) obj->dslots = NULL; return obj; } - -JS_DEFINE_TRCINFO_1(js_Date, - (2, (static, CONSTRUCTOR_RETRY, Date_tn, CONTEXT, CALLEE_PROTO, 0, 0))) - #endif JSObject * @@ -2218,10 +2216,6 @@ js_InitDateClass(JSContext *cx, JSObject *obj) if (!proto) return NULL; -#ifdef JS_TRACER - js_SetTraceableNative(cx, proto, js_Date_trcinfo); -#endif - /* Alias toUTCString with toGMTString. (ECMA B.2.6) */ if (!JS_AliasProperty(cx, proto, "toUTCString", "toGMTString")) return NULL; diff --git a/js/src/jsfun.h b/js/src/jsfun.h index 403db075ebf7..b5b9c5c4f3b1 100644 --- a/js/src/jsfun.h +++ b/js/src/jsfun.h @@ -73,10 +73,12 @@ struct JSFunction { uint16 extra; /* number of arg slots for local GC roots */ uint16 spare; /* reserved for future use */ JSNative native; /* native method pointer or null */ - JSClass *clasp; /* class of objects constructed - by this function */ - JSTraceableNative *trcinfo; /* tracer metadata; can be first - element of array */ + union { + JSClass *clasp; /* class of objects constructed + by this function */ + JSTraceableNative *trcinfo; /* tracer metadata; can be first + element of array */ + } u; } n; struct { uint16 nvars; /* number of local variables */ @@ -109,10 +111,11 @@ struct JSFunction { ? 0 \ : (fun)->nargs) #define FUN_CLASP(fun) (JS_ASSERT(!FUN_INTERPRETED(fun)), \ - fun->u.n.clasp) + JS_ASSERT(!((fun)->flags & JSFUN_TRACEABLE)), \ + fun->u.n.u.clasp) #define FUN_TRCINFO(fun) (JS_ASSERT(!FUN_INTERPRETED(fun)), \ JS_ASSERT((fun)->flags & JSFUN_TRACEABLE), \ - fun->u.n.trcinfo) + fun->u.n.u.trcinfo) /* * Traceable native. This expands to a JSFunctionSpec initializer (like JS_FN diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp index 2f7ad0f50f99..55667ed777ca 100644 --- a/js/src/jsinterp.cpp +++ b/js/src/jsinterp.cpp @@ -1794,8 +1794,11 @@ js_InvokeConstructor(JSContext *cx, uintN argc, JSBool clampReturn, jsval *vp) if (OBJ_GET_CLASS(cx, obj2) == &js_FunctionClass) { fun2 = GET_FUNCTION_PRIVATE(cx, obj2); - if (!FUN_INTERPRETED(fun2) && fun2->u.n.clasp) - clasp = fun2->u.n.clasp; + if (!FUN_INTERPRETED(fun2) && + !(fun2->flags & JSFUN_TRACEABLE) && + fun2->u.n.u.clasp) { + clasp = fun2->u.n.u.clasp; + } } } obj = js_NewObject(cx, clasp, proto, parent, 0); diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp index a0e447ac1bce..067abf383f18 100644 --- a/js/src/jsobj.cpp +++ b/js/src/jsobj.cpp @@ -2010,57 +2010,6 @@ js_Object(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval) return JS_TRUE; } -#ifdef JS_TRACER -JSObject* FASTCALL -js_Object_tn(JSContext* cx, JSObject* ctor) -{ - JS_ASSERT(HAS_FUNCTION_CLASS(ctor)); - JSFunction* fun = GET_FUNCTION_PRIVATE(cx, ctor); - JSClass* clasp = (FUN_INTERPRETED(fun) || (fun->flags & JSFUN_TRACEABLE)) - ? &js_ObjectClass - : FUN_CLASP(fun); - JS_ASSERT(clasp != &js_ArrayClass); - - JS_LOCK_OBJ(cx, ctor); - JSScope *scope = OBJ_SCOPE(ctor); - JS_ASSERT(scope->object == ctor); - JSAtom* atom = cx->runtime->atomState.classPrototypeAtom; - - JSScopeProperty *sprop = SCOPE_GET_PROPERTY(scope, ATOM_TO_JSID(atom)); - JS_ASSERT(SPROP_HAS_VALID_SLOT(sprop, scope)); - jsval v = LOCKED_OBJ_GET_SLOT(ctor, sprop->slot); - JS_UNLOCK_SCOPE(cx, scope); - - JSObject* proto; - if (JSVAL_IS_PRIMITIVE(v)) { - if (!js_GetClassPrototype(cx, JSVAL_TO_OBJECT(ctor->fslots[JSSLOT_PARENT]), - INT_TO_JSID(JSProto_Object), &proto)) { - return NULL; - } - } else { - proto = JSVAL_TO_OBJECT(v); - } - - JS_ASSERT(JS_ON_TRACE(cx)); - JSObject* obj = (JSObject*) js_NewGCThing(cx, GCX_OBJECT, sizeof(JSObject)); - if (!obj) - return NULL; - - obj->classword = jsuword(clasp); - obj->fslots[JSSLOT_PROTO] = OBJECT_TO_JSVAL(proto); - obj->fslots[JSSLOT_PARENT] = ctor->fslots[JSSLOT_PARENT]; - for (unsigned i = JSSLOT_PRIVATE; i != JS_INITIAL_NSLOTS; ++i) - obj->fslots[i] = JSVAL_VOID; - - obj->map = js_HoldObjectMap(cx, proto->map); - obj->dslots = NULL; - return obj; -} - -JS_DEFINE_TRCINFO_1(js_Object, - (2, (extern, CONSTRUCTOR_RETRY, js_Object_tn, CONTEXT, CALLEE, 0, 0))) -#endif - /* * Given pc pointing after a property accessing bytecode, return true if the * access is "object-detecting" in the sense used by web scripts, e.g., when @@ -2633,14 +2582,9 @@ js_InitEval(JSContext *cx, JSObject *obj) JSObject * js_InitObjectClass(JSContext *cx, JSObject *obj) { - JSObject *proto = JS_InitClass(cx, obj, NULL, &js_ObjectClass, js_Object, - 1, object_props, object_methods, NULL, - object_static_methods); -#ifdef JS_TRACER - if (proto) - js_SetTraceableNative(cx, proto, js_Object_trcinfo); -#endif - return proto; + return JS_InitClass(cx, obj, NULL, &js_ObjectClass, js_Object, 1, + object_props, object_methods, NULL, + object_static_methods); } void @@ -5651,15 +5595,6 @@ js_GetWrappedObject(JSContext *cx, JSObject *obj) return obj; } -void -js_SetTraceableNative(JSContext *cx, JSObject *proto, JSTraceableNative *trcinfo) -{ - JSFunction *fun = GET_FUNCTION_PRIVATE(cx, JS_GetConstructor(cx, proto)); - JS_ASSERT(!(fun->flags & JSFUN_TRACEABLE)); - fun->u.n.trcinfo = trcinfo; - fun->flags |= JSFUN_TRACEABLE; -} - #ifdef DEBUG /* diff --git a/js/src/jsobj.h b/js/src/jsobj.h index a4a3a1cf2552..4d5a4ff5d19b 100644 --- a/js/src/jsobj.h +++ b/js/src/jsobj.h @@ -764,9 +764,6 @@ JS_FRIEND_API(void) js_DumpId(jsid id); JS_FRIEND_API(void) js_DumpObject(JSObject *obj); #endif -extern void -js_SetTraceableNative(JSContext *cx, JSObject *proto, JSTraceableNative* trcinfo); - JS_END_EXTERN_C #endif /* jsobj_h___ */ diff --git a/js/src/jsstr.cpp b/js/src/jsstr.cpp index bc62133abe91..a7937232d2fd 100644 --- a/js/src/jsstr.cpp +++ b/js/src/jsstr.cpp @@ -2521,7 +2521,7 @@ JS_DEFINE_TRCINFO_3(str_replace, (4, (static, STRING_RETRY, String_p_replace_str2, CONTEXT, THIS_STRING, STRING, STRING, 1, 1)), (5, (static, STRING_RETRY, String_p_replace_str3, CONTEXT, THIS_STRING, STRING, STRING, STRING, 1, 1))) JS_DEFINE_TRCINFO_1(str_split, - (3, (static, OBJECT_RETRY, String_p_split, CONTEXT, THIS_STRING, STRING, 0, 0))) + (3, (static, OBJECT_RETRY_NULL, String_p_split, CONTEXT, THIS_STRING, STRING, 0, 0))) JS_DEFINE_TRCINFO_1(str_toLowerCase, (2, (extern, STRING_RETRY, js_toLowerCase, CONTEXT, THIS_STRING, 1, 1))) JS_DEFINE_TRCINFO_1(str_toUpperCase, diff --git a/js/src/jstracer.cpp b/js/src/jstracer.cpp index ed11171c3a3b..010540627526 100644 --- a/js/src/jstracer.cpp +++ b/js/src/jstracer.cpp @@ -6642,22 +6642,25 @@ TraceRecorder::functionCall(bool constructing, uintN argc) if (FUN_INTERPRETED(fun)) { if (constructing) { LIns* args[] = { get(&fval), cx_ins }; - LIns* tv_ins = lir->insCall(&js_Object_tn_ci, args); + LIns* tv_ins = lir->insCall(&js_FastNewObject_ci, args); guard(false, lir->ins_eq0(tv_ins), OOM_EXIT); set(&tval, tv_ins); } return interpretedFunctionCall(fval, fun, argc, constructing); } - if (!(fun->flags & JSFUN_TRACEABLE)) + if (!constructing && !(fun->flags & JSFUN_TRACEABLE)) ABORT_TRACE("untraceable native"); - JSTraceableNative* known = FUN_TRCINFO(fun); - JS_ASSERT(known && (JSFastNative)fun->u.n.native == known->native); + static JSTraceableNative knownNatives[] = { + { (JSFastNative)js_Object, &js_FastNewObject_ci, "fC", "", FAIL_NULL | JSTN_MORE }, + { (JSFastNative)js_Date, &js_FastNewDate_ci, "pC", "", FAIL_NULL }, + }; LIns* args[5]; + JSTraceableNative* known = constructing ? knownNatives : FUN_TRCINFO(fun); do { - if (((known->flags & JSTN_CONSTRUCTOR) != 0) != constructing) + if (constructing && (JSFastNative)fun->u.n.native != known->native) continue; uintN knownargc = strlen(known->argtypes); @@ -8061,7 +8064,7 @@ TraceRecorder::record_JSOP_NEWINIT() if (JSVAL_IS_PRIMITIVE(v_obj)) ABORT_TRACE("primitive Object value"); obj = JSVAL_TO_OBJECT(v_obj); - ci = &js_Object_tn_ci; + ci = &js_FastNewObject_ci; } LIns* args[] = { INS_CONSTPTR(obj), cx_ins }; LIns* v_ins = lir->insCall(ci, args);