From f11b40c3ab4a5a766b0b71ab1e9a6199b23bbfeb Mon Sep 17 00:00:00 2001
From: "Matt A. Tobin" <email@mattatobin.com>
Date: Sun, 29 May 2022 00:47:25 -0500
Subject: [JS:Engine] Remove the use of tagged shape pointers

---
 js/src/vm/Shape-inl.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'js/src/vm/Shape-inl.h')

diff --git a/js/src/vm/Shape-inl.h b/js/src/vm/Shape-inl.h
index 32754740a..7b7561220 100644
--- a/js/src/vm/Shape-inl.h
+++ b/js/src/vm/Shape-inl.h
@@ -123,7 +123,7 @@ Shape::new_(ExclusiveContext* cx, Handle<StackShape> other, uint32_t nfixed)
 inline void
 Shape::updateBaseShapeAfterMovingGC()
 {
-    BaseShape* base = base_.unbarrieredGet();
+    BaseShape* base = base_;
     if (IsForwarded(base))
         base_.unsafeSet(Forwarded(base));
 }
@@ -191,17 +191,17 @@ AutoRooterGetterSetter::AutoRooterGetterSetter(ExclusiveContext* cx, uint8_t att
 }
 
 static inline uint8_t
-GetShapeAttributes(JSObject* obj, Shape* shape)
+GetPropertyAttributes(JSObject* obj, PropertyResult prop)
 {
     MOZ_ASSERT(obj->isNative());
 
-    if (IsImplicitDenseOrTypedArrayElement(shape)) {
+    if (prop.isDenseOrTypedArrayElement()) {
         if (obj->is<TypedArrayObject>())
             return JSPROP_ENUMERATE | JSPROP_PERMANENT;
         return obj->as<NativeObject>().getElementsHeader()->elementAttributes();
     }
 
-    return shape->attributes();
+    return prop.shape()->attributes();
 }
 
 } /* namespace js */
-- 
cgit v1.2.3