diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp index bc550bd7f76b..a488d9798e3d 100644 --- a/js/src/jit/MIR.cpp +++ b/js/src/jit/MIR.cpp @@ -4191,6 +4191,10 @@ MaybeUnwrapElements(const MDefinition* elementsOrObj) if (elementsOrObj->type() == MIRType_Object) return nullptr; + // MTypedArrayElements and MTypedObjectElements aren't handled. + if (!elementsOrObj->isElements()) + return nullptr; + return elementsOrObj->toElements(); } @@ -4201,12 +4205,14 @@ GetStoreObject(const MDefinition* store) switch (store->op()) { case MDefinition::Op_StoreElement: { const MDefinition* elementsOrObj = store->toStoreElement()->elements(); + if (elementsOrObj->type() == MIRType_Object) + return elementsOrObj; + const MDefinition* elements = MaybeUnwrapElements(elementsOrObj); if (elements) return elements->toElements()->input(); - MOZ_ASSERT(elementsOrObj->type() == MIRType_Object); - return elementsOrObj; + return nullptr; } case MDefinition::Op_StoreElementHole: @@ -4225,7 +4231,11 @@ GenericLoadMightAlias(const MDefinition* elementsOrObj, const MDefinition* store if (elements) return elements->mightAlias(store); - // If MElements couldn't be extracted, then storage must be inline. + // Unhandled Elements kind. + if (elementsOrObj->type() != MIRType_Object) + return true; + + // Inline storage for objects. // Refer to IsValidElementsType(). const MDefinition* object = elementsOrObj; MOZ_ASSERT(object->type() == MIRType_Object);