diff --git a/js/src/jit/CacheIR.cpp b/js/src/jit/CacheIR.cpp index b28221807a7f..be298e55ca07 100644 --- a/js/src/jit/CacheIR.cpp +++ b/js/src/jit/CacheIR.cpp @@ -10884,8 +10884,8 @@ AttachDecision CallIRGenerator::tryAttachCallNative(HandleFunction calleeFunc) { writer.loadArgumentDynamicSlot(ArgumentKind::This, argcId, flags); ObjOperandId thisObjId = writer.guardToObject(thisValId); - // Guard on the |this| class to make sure it's the right instance. - writer.guardAnyClass(thisObjId, thisval_.toObject().getClass()); + // Guard on the |this| shape to make sure it's the right instance. + writer.guardShape(thisObjId, thisval_.toObject().shape()); // Ensure callee matches this stub's callee writer.guardSpecificFunction(calleeObjId, calleeFunc); diff --git a/js/src/jit/WarpBuilderShared.h b/js/src/jit/WarpBuilderShared.h index 53fbb44fd0d7..fab9b133a73c 100644 --- a/js/src/jit/WarpBuilderShared.h +++ b/js/src/jit/WarpBuilderShared.h @@ -313,12 +313,12 @@ MCall* MakeCall(TempAllocator& alloc, Undef addUndefined, CallInfo& callInfo, mozilla::Maybe objKind; if (isDOMCall) { - const JSClass* clasp = callInfo.thisArg()->toGuardToClass()->getClass(); - MOZ_ASSERT(clasp->isDOMClass()); - if (clasp->isNativeObject()) { + const Shape* shape = callInfo.thisArg()->toGuardShape()->shape(); + MOZ_ASSERT(shape->getObjectClass()->isDOMClass()); + if (shape->isNative()) { objKind.emplace(DOMObjectKind::Native); } else { - MOZ_ASSERT(clasp->isProxyObject()); + MOZ_ASSERT(shape->isProxy()); objKind.emplace(DOMObjectKind::Proxy); } }