Merge branch 'master' into pr/yongqu/module

Yongqu · Yongqu · commit d4ac98e6434f · 2016-02-23T06:31:11.000-08:00
diff --git a/bin/GCStress/GCStress.vcxproj b/bin/GCStress/GCStress.vcxproj
@@ -36,29 +36,29 @@
     <ClCompile Include="GCStress.cpp" />
     <ClCompile Include="RecyclerTestObject.cpp" />
     <ClCompile Include="stdafx.cpp" />
-    <ClCompile Include="StubExternalAPI.cpp" />
+    <ClCompile Include="StubExternalApi.cpp" />
   </ItemGroup>
   <ItemGroup>
-    <ProjectReference Include="..\..\lib\common\common\Chakra.Common.Common.vcxproj">
+    <ProjectReference Include="..\..\lib\Common\Common\Chakra.Common.Common.vcxproj">
       <Project>{bb4153ff-ac3e-4734-b562-cc23812df31b}</Project>
     </ProjectReference>
-    <ProjectReference Include="..\..\lib\common\core\Chakra.Common.Core.vcxproj">
+    <ProjectReference Include="..\..\lib\Common\Core\Chakra.Common.Core.vcxproj">
       <Project>{cc4153ff-ac3e-4734-b562-cc23812df31b}</Project>
     </ProjectReference>
-    <ProjectReference Include="..\..\lib\common\DataStructures\Chakra.Common.DataStructures.vcxproj">
+    <ProjectReference Include="..\..\lib\Common\DataStructures\Chakra.Common.DataStructures.vcxproj">
       <Project>{5643d42a-c38d-4d82-9662-58470b3ac9f7}</Project>
     </ProjectReference>
-    <ProjectReference Include="..\..\lib\common\Exceptions\Chakra.Common.Exceptions.vcxproj">
+    <ProjectReference Include="..\..\lib\Common\Exceptions\Chakra.Common.Exceptions.vcxproj">
       <Project>{fd8eec40-4141-448a-bf4b-1589fbe4f60d}</Project>
     </ProjectReference>
-    <ProjectReference Include="..\..\lib\common\Memory\Chakra.Common.Memory.vcxproj">
+    <ProjectReference Include="..\..\lib\Common\Memory\Chakra.Common.Memory.vcxproj">
       <Project>{bb4153ff-ac3e-4734-b562-ff23812df31b}</Project>
     </ProjectReference>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="GCStress.h" />
     <ClInclude Include="RecyclerTestObject.h" />
-    <ClInclude Include="StdAfx.h" />
+    <ClInclude Include="stdafx.h" />
     <ClInclude Include="WeightedTable.h" />
   </ItemGroup>
   <Import Project="$(BuildConfigPropsPath)Chakra.Build.targets" Condition="exists('$(BuildConfigPropsPath)Chakra.Build.targets')" />
diff --git a/bin/GCStress/GCStress.vcxproj.filters b/bin/GCStress/GCStress.vcxproj.filters
@@ -24,7 +24,7 @@
     <ClCompile Include="stdafx.cpp">
       <Filter>Source Files</Filter>
     </ClCompile>
-    <ClCompile Include="StubExternalAPI.cpp">
+    <ClCompile Include="StubExternalApi.cpp">
       <Filter>Source Files</Filter>
     </ClCompile>
   </ItemGroup>
@@ -35,7 +35,7 @@
     <ClInclude Include="RecyclerTestObject.h">
       <Filter>Header Files</Filter>
     </ClInclude>
-    <ClInclude Include="StdAfx.h">
+    <ClInclude Include="stdafx.h">
       <Filter>Header Files</Filter>
     </ClInclude>
     <ClInclude Include="WeightedTable.h">
diff --git a/bin/GCStress/StubExternalApi.cpp b/bin/GCStress/StubExternalApi.cpp
@@ -3,17 +3,17 @@
 // Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
 //-------------------------------------------------------------------------------------------------------
 #include "Common.h"
-#include "commoninl.h" // TODO: Try to remove this later
+#include "CommonInl.h" // TODO: Try to remove this later
 
-#include "core\ConfigParser.h"
+#include "Core/ConfigParser.h"
 
 // TODO: REMOVE
 __forceinline void js_memcpy_s(__bcount(sizeInBytes) void *dst, size_t sizeInBytes, __in_bcount(count) const void *src, size_t count)
 {
     Assert((count) <= (sizeInBytes));
     if ((count) <= (sizeInBytes))
         memcpy((dst), (src), (count));
-    else                              
+    else
         ReportFatalException(NULL, E_FAIL, Fatal_Internal_Error, 2);
 }
 
diff --git a/bin/GCStress/stdafx.h b/bin/GCStress/stdafx.h
diff --git a/bin/ch/ChakraRtInterface.cpp b/bin/ch/ChakraRtInterface.cpp
diff --git a/bin/ch/ChakraRtInterface.h b/bin/ch/ChakraRtInterface.h
diff --git a/bin/ch/ch.vcxproj b/bin/ch/ch.vcxproj
@@ -48,7 +48,7 @@
     </ResourceCompile>
   </ItemGroup>
   <ItemGroup>
-    <ClInclude Include="chakrartinterface.h" />
+    <ClInclude Include="ChakraRtInterface.h" />
     <ClInclude Include="Helpers.h" />
     <ClInclude Include="HostConfigFlags.h" />
     <ClInclude Include="HostConfigFlagsList.h" />
@@ -58,7 +58,7 @@
   </ItemGroup>
   <ItemGroup>
     <ClCompile Include="ch.cpp" />
-    <ClCompile Include="chakrartinterface.cpp" />
+    <ClCompile Include="ChakraRtInterface.cpp" />
     <ClCompile Include="CodexAssert.cpp" />
     <ClCompile Include="Helpers.cpp" />
     <ClCompile Include="HostConfigFlags.cpp" />
diff --git a/bin/ch/stdafx.h b/bin/ch/stdafx.h
@@ -73,7 +73,7 @@ if (!(exp)) \
 typedef void * Var;
 
 #include "TestHooks.h"
-#include "chakrartinterface.h"
+#include "ChakraRtInterface.h"
 #include "Helpers.h"
 #include "HostConfigFlags.h"
 #include "MessageQueue.h"
diff --git a/lib/Backend/BackwardPass.cpp b/lib/Backend/BackwardPass.cpp
@@ -1069,10 +1069,17 @@ BackwardPass::MergeGuardedProperties(ObjTypeGuardBucket bucket1, ObjTypeGuardBuc
 
     ObjTypeGuardBucket bucket;
     bucket.SetGuardedPropertyOps(mergedPropertyOps);
-    if (bucket1.NeedsMonoCheck() || bucket2.NeedsMonoCheck())
+    Js::Type *monoGuardType = bucket1.GetMonoGuardType();
+    if (monoGuardType != nullptr)
     {
-        bucket.SetNeedsMonoCheck(true);
+        Assert(!bucket2.NeedsMonoCheck() || monoGuardType == bucket2.GetMonoGuardType());
     }
+    else
+    {
+        monoGuardType = bucket2.GetMonoGuardType();
+    }
+    bucket.SetMonoGuardType(monoGuardType);
+
     return bucket;
 }
 
@@ -3988,7 +3995,8 @@ BackwardPass::TrackObjTypeSpecProperties(IR::PropertySymOpnd *opnd, BasicBlock *
         if (opnd->NeedsMonoCheck())
         {
             Assert(opnd->IsMono());
-            bucket->SetNeedsMonoCheck(true);
+            Js::Type *monoGuardType = opnd->HasInitialType() ? opnd->GetInitialType() : opnd->GetType();
+            bucket->SetMonoGuardType(monoGuardType);
         }
 
         if (opnd->NeedsPrimaryTypeCheck())
@@ -4013,11 +4021,10 @@ BackwardPass::TrackObjTypeSpecProperties(IR::PropertySymOpnd *opnd, BasicBlock *
                 {
                     // Some instr protected by this one requires a monomorphic type check. (E.g., final type opt,
                     // fixed field not loaded from prototype.)
-                    Assert(opnd->IsMono());
-                    opnd->SetMustDoMonoCheck(true);
+                    opnd->SetMonoGuardType(bucket->GetMonoGuardType());
                     this->currentInstr->ChangeEquivalentToMonoTypeCheckBailOut();
                 }
-                bucket->SetNeedsMonoCheck(false);
+                bucket->SetMonoGuardType(nullptr);
             }
 
             bucket->SetGuardedPropertyOps(nullptr);
diff --git a/lib/Backend/FlowGraph.h b/lib/Backend/FlowGraph.h
@@ -71,28 +71,29 @@ class ObjTypeGuardBucket
 {
 private:
     BVSparse<JitArenaAllocator>* guardedPropertyOps;
-    bool needsMonoCheck;
+    Js::Type *                   monoGuardType;
 
 public:
-    ObjTypeGuardBucket() : guardedPropertyOps(nullptr), needsMonoCheck(false) {}
+    ObjTypeGuardBucket() : guardedPropertyOps(nullptr), monoGuardType(nullptr) {}
 
-    ObjTypeGuardBucket(BVSparse<JitArenaAllocator>* guardedPropertyOps) : needsMonoCheck(false)
+    ObjTypeGuardBucket(BVSparse<JitArenaAllocator>* guardedPropertyOps) : monoGuardType(nullptr)
     {
         this->guardedPropertyOps = (guardedPropertyOps != nullptr ? guardedPropertyOps->CopyNew() : nullptr);
     }
 
     void Copy(ObjTypeGuardBucket *pNew) const
     {
         pNew->guardedPropertyOps = this->guardedPropertyOps ? this->guardedPropertyOps->CopyNew() : nullptr;
-        pNew->needsMonoCheck = this->needsMonoCheck;
+        pNew->monoGuardType = this->monoGuardType;
     }
 
     BVSparse<JitArenaAllocator> *GetGuardedPropertyOps() const  { return this->guardedPropertyOps; }
     void SetGuardedPropertyOps(BVSparse<JitArenaAllocator> *guardedPropertyOps) { this->guardedPropertyOps = guardedPropertyOps; }
     void AddToGuardedPropertyOps(uint propertyOpId) { Assert(this->guardedPropertyOps != nullptr); this->guardedPropertyOps->Set(propertyOpId); }
 
-    bool NeedsMonoCheck() const { return this->needsMonoCheck; }
-    void SetNeedsMonoCheck(bool value) { this->needsMonoCheck = value; }
+    bool NeedsMonoCheck() const { return this->monoGuardType != nullptr; }
+    void SetMonoGuardType(Js::Type *type) { this->monoGuardType = type; }
+    Js::Type * GetMonoGuardType() const { return this->monoGuardType; }
 
 #if DBG_DUMP
     void Dump() const;
diff --git a/lib/Backend/Lower.cpp b/lib/Backend/Lower.cpp
@@ -6762,7 +6762,8 @@ Lowerer::GenerateCachedTypeCheck(IR::Instr *instrChk, IR::PropertySymOpnd *prope
         (propertySymOpnd->IsPoly() || instrChk->HasTypeCheckBailOut());
     Assert(doEquivTypeCheck || !instrChk->HasEquivalentTypeCheckBailOut());
 
-    Js::Type* type = doEquivTypeCheck ? propertySymOpnd->GetFirstEquivalentType() : propertySymOpnd->GetType();
+    Js::Type* type = propertySymOpnd->MustDoMonoCheck() ? propertySymOpnd->GetMonoGuardType() :
+        doEquivTypeCheck ? propertySymOpnd->GetFirstEquivalentType() : propertySymOpnd->GetType();
 
     Js::PropertyGuard* typeCheckGuard = doEquivTypeCheck ?
         (Js::PropertyGuard*)CreateEquivalentTypeGuardAndLinkToGuardedProperties(type, propertySymOpnd) :
diff --git a/lib/Backend/Opnd.cpp b/lib/Backend/Opnd.cpp
@@ -715,6 +715,7 @@ PropertySymOpnd::New(PropertySym *propertySym, IRType type, Func *func)
     newOpnd->m_type = type;
     newOpnd->SetObjTypeSpecFldInfo(nullptr);
     newOpnd->finalType = nullptr;
+    newOpnd->monoGuardType = nullptr;
     newOpnd->guardedPropOps = nullptr;
     newOpnd->writeGuards = nullptr;
     newOpnd->objTypeSpecFlags = 0;
diff --git a/lib/Backend/Opnd.h b/lib/Backend/Opnd.h
@@ -506,6 +506,7 @@ class PropertySymOpnd sealed : public SymOpnd
     Js::ObjTypeSpecFldInfo* objTypeSpecFldInfo;
 public:
     Js::Type* finalType;
+    Js::Type* monoGuardType;
     BVSparse<JitArenaAllocator>* guardedPropOps;
     BVSparse<JitArenaAllocator>* writeGuards;
     byte m_polyCacheUtil;
@@ -534,7 +535,6 @@ class PropertySymOpnd sealed : public SymOpnd
                     bool typeDead: 1;
                     bool typeChecked: 1;
                     bool initialTypeChecked: 1;
-                    bool mustDoMonoCheck: 1;
                     bool typeMismatch: 1;
                     bool writeGuardChecked: 1;
                 };
@@ -667,14 +667,17 @@ class PropertySymOpnd sealed : public SymOpnd
 
     bool MustDoMonoCheck() const
     {
-        // Question: does this property access need to do a monomorphic check because of some other access
-        // that this check protects?
-        return this->mustDoMonoCheck;
+        return this->monoGuardType != nullptr;
     }
 
-    void SetMustDoMonoCheck(bool value)
+    Js::Type * GetMonoGuardType() const
     {
-        this->mustDoMonoCheck = value;
+        return this->monoGuardType;
+    }
+
+    void SetMonoGuardType(Js::Type *type)
+    {
+        this->monoGuardType = type;
     }
 
     bool NeedsMonoCheck() const
diff --git a/lib/Common/Common.h b/lib/Common/Common.h
@@ -125,9 +125,9 @@ template<> struct IntMath<int64> { using Type = Int64Math; };
 #include "Common/Event.h"
 #include "Common/Jobs.h"
 
-#include "common\vtregistry.h" // Depends on SimpleHashTable.h
-#include "DataStructures\Cache.h" // Depends on config flags
-#include "DataStructures\MruDictionary.h" // Depends on DoublyLinkedListElement
+#include "Common/vtregistry.h" // Depends on SimpleHashTable.h
+#include "DataStructures/Cache.h" // Depends on config flags
+#include "DataStructures/MruDictionary.h" // Depends on DoublyLinkedListElement
 
 #include "Common/SmartFpuControl.h"
 
diff --git a/lib/Parser/Parse.cpp b/lib/Parser/Parse.cpp
@@ -1953,7 +1953,7 @@ void Parser::ReduceDeferredScriptLength(size_t chars)
     if ((m_grfscr & fscrDeferFncParse) &&
         (
             PHASE_OFF1(Js::DeferEventHandlersPhase) || 
-            !(m_grfscr & (fscrImplicitThis|fscrImplicitParents))
+            (m_grfscr & fscrGlobalCode)
         )
     )
     {
@@ -10391,7 +10391,7 @@ ParseNodePtr Parser::Parse(LPCUTF8 pszSrc, size_t offset, size_t length, charcou
         // by command-line switch.
         grfscr &= ~fscrDeferFncParse;
     }
-    else if ((grfscr & (fscrImplicitThis | fscrImplicitParents)) &&
+    else if (!(grfscr & fscrGlobalCode) &&
              (
                  PHASE_OFF1(Js::Phase::DeferEventHandlersPhase) ||
                  this->m_scriptContext->IsInDebugOrSourceRundownMode()
diff --git a/lib/Runtime/Language/InlineCache.inl b/lib/Runtime/Language/InlineCache.inl
@@ -37,7 +37,7 @@ namespace Js
             Assert(propertyObject->GetScriptContext() == requestContext); // we never cache a type from another script context
             *propertyValue = DynamicObject::FromVar(propertyObject)->GetInlineSlot(u.local.slotIndex);
             Assert(*propertyValue == JavascriptOperators::GetProperty(propertyObject, propertyId, requestContext) ||
-                *propertyValue == JavascriptOperators::GetRootProperty(propertyObject, propertyId, requestContext));
+                (RootObjectBase::Is(propertyObject) && *propertyValue == JavascriptOperators::GetRootProperty(propertyObject, propertyId, requestContext)));
             if (ReturnOperationInfo)
             {
                 operationInfo->cacheType = CacheType_Local;
@@ -51,7 +51,7 @@ namespace Js
             Assert(propertyObject->GetScriptContext() == requestContext); // we never cache a type from another script context
             *propertyValue = DynamicObject::FromVar(propertyObject)->GetAuxSlot(u.local.slotIndex);
             Assert(*propertyValue == JavascriptOperators::GetProperty(propertyObject, propertyId, requestContext) ||
-                *propertyValue == JavascriptOperators::GetRootProperty(propertyObject, propertyId, requestContext));
+                (RootObjectBase::Is(propertyObject) && *propertyValue == JavascriptOperators::GetRootProperty(propertyObject, propertyId, requestContext)));
             if (ReturnOperationInfo)
             {
                 operationInfo->cacheType = CacheType_Local;
@@ -65,7 +65,7 @@ namespace Js
             Assert(u.proto.prototypeObject->GetScriptContext() == requestContext); // we never cache a type from another script context
             *propertyValue = u.proto.prototypeObject->GetInlineSlot(u.proto.slotIndex);
             Assert(*propertyValue == JavascriptOperators::GetProperty(propertyObject, propertyId, requestContext) ||
-                *propertyValue == JavascriptOperators::GetRootProperty(propertyObject, propertyId, requestContext));
+                (RootObjectBase::Is(propertyObject) && *propertyValue == JavascriptOperators::GetRootProperty(propertyObject, propertyId, requestContext)));
             if (ReturnOperationInfo)
             {
                 operationInfo->cacheType = CacheType_Proto;
@@ -78,10 +78,8 @@ namespace Js
         {
             Assert(u.proto.prototypeObject->GetScriptContext() == requestContext); // we never cache a type from another script context
             *propertyValue = u.proto.prototypeObject->GetAuxSlot(u.proto.slotIndex);
-            // TODO: This assert often results in Assert(RootObjectBase::Is(object)) inside GetRootProperty, which is misleading
-            // when the problem is that GetProperty returned a different value than propertyValue. Consider reworking it here and elsewhere.
             Assert(*propertyValue == JavascriptOperators::GetProperty(propertyObject, propertyId, requestContext) ||
-                *propertyValue == JavascriptOperators::GetRootProperty(propertyObject, propertyId, requestContext));
+                (RootObjectBase::Is(propertyObject) && *propertyValue == JavascriptOperators::GetRootProperty(propertyObject, propertyId, requestContext)));
             if (ReturnOperationInfo)
             {
                 operationInfo->cacheType = CacheType_Proto;
@@ -136,10 +134,8 @@ namespace Js
         {
             Assert(u.proto.prototypeObject->GetScriptContext() == requestContext); // we never cache a type from another script context
             *propertyValue = u.proto.prototypeObject->GetInlineSlot(u.proto.slotIndex);
-            // TODO: This assert often results in Assert(RootObjectBase::Is(object)) inside GetRootProperty, which is misleading
-            // when the problem is that GetProperty returned a different value than propertyValue. Consider reworking it here and elsewhere.
             Assert(*propertyValue == JavascriptOperators::GetProperty(propertyObject, propertyId, requestContext) ||
-                *propertyValue == JavascriptOperators::GetRootProperty(propertyObject, propertyId, requestContext));
+                (RootObjectBase::Is(propertyObject) && *propertyValue == JavascriptOperators::GetRootProperty(propertyObject, propertyId, requestContext)));
 
 #ifdef MISSING_PROPERTY_STATS
             if (PHASE_STATS1(MissingPropertyCachePhase))
@@ -160,10 +156,8 @@ namespace Js
         {
             Assert(u.proto.prototypeObject->GetScriptContext() == requestContext); // we never cache a type from another script context
             *propertyValue = u.proto.prototypeObject->GetAuxSlot(u.proto.slotIndex);
-            // TODO: This assert often results in Assert(RootObjectBase::Is(object)) inside GetRootProperty, which is misleading
-            // when the problem is that GetProperty returned a different value than propertyValue. Consider reworking it here and elsewhere.
             Assert(*propertyValue == JavascriptOperators::GetProperty(propertyObject, propertyId, requestContext) ||
-                *propertyValue == JavascriptOperators::GetRootProperty(propertyObject, propertyId, requestContext));
+                (RootObjectBase::Is(propertyObject) && *propertyValue == JavascriptOperators::GetRootProperty(propertyObject, propertyId, requestContext)));
 
 #ifdef MISSING_PROPERTY_STATS
             if (PHASE_STATS1(MissingPropertyCachePhase))
diff --git a/test/fieldopts/fixedfieldmonocheck.js b/test/fieldopts/fixedfieldmonocheck.js
@@ -0,0 +1,55 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+
+function test0() {
+    var GiantPrintArray = [];
+    var obj0 = {};
+    var protoObj0 = {};
+    var protoObj1 = {};
+    var obj2 = {};
+    var protoObj2 = {};
+    var func0 = function () {
+        if ({} instanceof EvalError ^ (parseInt()) * (ary - protoObj2.prop6)) {
+            var uniqobj1 = uniqobj0;
+        } else {
+            protoObj0.prop4 = uic8;
+            ({ b: { n: protoObj1.prop0 } });
+            for (var v0 = 0; v0 < 3; v0++) {
+                protoObj1.prop4 = protoObj1.prop1 === protoObj1 && obj2 === protoObj1.prop6;
+            }
+        }
+        GiantPrintArray.push(protoObj1.prop5);
+    };
+    var func1 = function () {
+        (function () {
+            Math.sin(new func0()) ? -(argMath10 * -921543659 - -1139958822.9) : prop4 = ui16;
+            func0(func0());
+        }(new func0()));
+    };
+    var func3 = function () {
+        var uniqobj6 = { 33: func1((new func0())) };
+    };
+    obj0.method0 = func3;
+    method1 = obj0.method0;
+    var ui16 = new Uint16Array();
+    var uic8 = new Uint8ClampedArray();
+    var VarArr0 = Array();
+    ary = 856134889;
+    protoObj0.prop0 = 194709012;
+    protoObj0.prop1 = -377120002;
+    protoObj0.prop2 = -1996023131.9;
+    protoObj0.prop3 = 114;
+    protoObj1.prop0 = -3;
+    protoObj1.prop1 = -1824894349.9;
+    protoObj1.prop2 = 1469720302881920000;
+    protoObj1.prop3 = -1231853442;
+    protoObj1.prop4 = -563681667;
+    protoObj1.prop5 = 1;
+    protoObj2.prop6 = -7120587829494880000;
+    method1(typeof (--protoObj2.prop6 >= (VarArr0[false ? VarArr0[17] = 'x' : undefined, 17] instanceof (typeof Object == 'function' ? Object : Object))));
+}
+test0();
+
+WScript.Echo('pass');
diff --git a/test/fieldopts/rlexe.xml b/test/fieldopts/rlexe.xml

Original file line number	Diff line number	Diff line change
`@@ -1069,10 +1069,17 @@ BackwardPass::MergeGuardedProperties(ObjTypeGuardBucket bucket1, ObjTypeGuardBuc`
`1069`	`1069`
`1070`	`1070`	`ObjTypeGuardBucket bucket;`
`1071`	`1071`	`bucket.SetGuardedPropertyOps(mergedPropertyOps);`
`1072`		`- if (bucket1.NeedsMonoCheck() \|\| bucket2.NeedsMonoCheck())`
	`1072`	`+ Js::Type *monoGuardType = bucket1.GetMonoGuardType();`
	`1073`	`+ if (monoGuardType != nullptr)`
`1073`	`1074`	`{`
`1074`		`- bucket.SetNeedsMonoCheck(true);`
	`1075`	`+ Assert(!bucket2.NeedsMonoCheck() \|\| monoGuardType == bucket2.GetMonoGuardType());`
`1075`	`1076`	`}`
	`1077`	`+ else`
	`1078`	`+ {`
	`1079`	`+ monoGuardType = bucket2.GetMonoGuardType();`
	`1080`	`+ }`
	`1081`	`+ bucket.SetMonoGuardType(monoGuardType);`
	`1082`	`+`
`1076`	`1083`	`return bucket;`
`1077`	`1084`	`}`
`1078`	`1085`
`@@ -3988,7 +3995,8 @@ BackwardPass::TrackObjTypeSpecProperties(IR::PropertySymOpnd opnd, BasicBlock `
`3988`	`3995`	`if (opnd->NeedsMonoCheck())`
`3989`	`3996`	`{`
`3990`	`3997`	`Assert(opnd->IsMono());`
`3991`		`- bucket->SetNeedsMonoCheck(true);`
	`3998`	`+ Js::Type *monoGuardType = opnd->HasInitialType() ? opnd->GetInitialType() : opnd->GetType();`
	`3999`	`+ bucket->SetMonoGuardType(monoGuardType);`
`3992`	`4000`	`}`
`3993`	`4001`
`3994`	`4002`	`if (opnd->NeedsPrimaryTypeCheck())`
`@@ -4013,11 +4021,10 @@ BackwardPass::TrackObjTypeSpecProperties(IR::PropertySymOpnd opnd, BasicBlock `
`4013`	`4021`	`{`
`4014`	`4022`	`// Some instr protected by this one requires a monomorphic type check. (E.g., final type opt,`
`4015`	`4023`	`// fixed field not loaded from prototype.)`
`4016`		`- Assert(opnd->IsMono());`
`4017`		`- opnd->SetMustDoMonoCheck(true);`
	`4024`	`+ opnd->SetMonoGuardType(bucket->GetMonoGuardType());`
`4018`	`4025`	`this->currentInstr->ChangeEquivalentToMonoTypeCheckBailOut();`
`4019`	`4026`	`}`
`4020`		`- bucket->SetNeedsMonoCheck(false);`
	`4027`	`+ bucket->SetMonoGuardType(nullptr);`
`4021`	`4028`	`}`
`4022`	`4029`
`4023`	`4030`	`bucket->SetGuardedPropertyOps(nullptr);`