// Callers are expected to have already guarded on the shape of the // object, which guarantees the object is a DOM proxy. static void CheckDOMProxyExpandoDoesNotShadow(CacheIRWriter& writer, JSObject* obj, jsid id, ObjOperandId objId) { MOZ_ASSERT(IsCacheableDOMProxy(obj)); Value expandoVal = GetProxyExtra(obj, GetDOMProxyExpandoSlot()); ValOperandId expandoId; if (!expandoVal.isObject() && !expandoVal.isUndefined()) { ExpandoAndGeneration* expandoAndGeneration = (ExpandoAndGeneration*)expandoVal.toPrivate(); expandoId = writer.guardDOMExpandoGeneration(objId, expandoAndGeneration, expandoAndGeneration->generation); expandoVal = expandoAndGeneration->expando; } else { expandoId = writer.loadDOMExpandoValue(objId); } if (expandoVal.isUndefined()) { // Guard there's no expando object. writer.guardType(expandoId, JSVAL_TYPE_UNDEFINED); } else if (expandoVal.isObject()) { // Guard the proxy either has no expando object or, if it has one, that // the shape matches the current expando object. NativeObject& expandoObj = expandoVal.toObject().as<NativeObject>(); MOZ_ASSERT(!expandoObj.containsPure(id)); writer.guardDOMExpandoObject(expandoId, expandoObj.lastProperty()); } else { MOZ_CRASH("Invalid expando value"); } }