// Callers are expected to have already guarded on the shape of the
// object, which guarantees the object is a DOM proxy.
static void
CheckDOMProxyExpandoDoesNotShadow(CacheIRWriter& writer, JSObject* obj, jsid id,
ObjOperandId objId)
{
MOZ_ASSERT(IsCacheableDOMProxy(obj));
Value expandoVal = GetProxyExtra(obj, GetDOMProxyExpandoSlot());
ValOperandId expandoId;
if (!expandoVal.isObject() && !expandoVal.isUndefined()) {
ExpandoAndGeneration* expandoAndGeneration = (ExpandoAndGeneration*)expandoVal.toPrivate();
expandoId = writer.guardDOMExpandoGeneration(objId, expandoAndGeneration,
expandoAndGeneration->generation);
expandoVal = expandoAndGeneration->expando;
} else {
expandoId = writer.loadDOMExpandoValue(objId);
}
if (expandoVal.isUndefined()) {
// Guard there's no expando object.
writer.guardType(expandoId, JSVAL_TYPE_UNDEFINED);
} else if (expandoVal.isObject()) {
// Guard the proxy either has no expando object or, if it has one, that
// the shape matches the current expando object.
NativeObject& expandoObj = expandoVal.toObject().as<NativeObject>();
MOZ_ASSERT(!expandoObj.containsPure(id));
writer.guardDOMExpandoObject(expandoId, expandoObj.lastProperty());
} else {
MOZ_CRASH("Invalid expando value");
}
}
