mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
[INFER] Assume double types for entries with empty type sets being merged into double phi nodes, bug 653249.
This commit is contained in:
parent
d868b00326
commit
052373f8bb
13
js/src/jit-test/tests/jaeger/bug653249.js
Normal file
13
js/src/jit-test/tests/jaeger/bug653249.js
Normal file
@ -0,0 +1,13 @@
|
||||
|
||||
function testUnaryImacros() {
|
||||
function checkArg(x) {
|
||||
o = {
|
||||
valueOf: checkArg
|
||||
}
|
||||
}
|
||||
var v = 0;
|
||||
v += +toString;
|
||||
for (var i = 0; i;) {
|
||||
v += [].checkArg.checkArg;
|
||||
}
|
||||
}(testUnaryImacros(), "valueOf passed, toString passed");
|
@ -7129,14 +7129,24 @@ mjit::Compiler::fixDoubleTypes(jsbytecode *target)
|
||||
continue;
|
||||
}
|
||||
if (newv->slot < analyze::TotalSlots(script)) {
|
||||
types::TypeSet *targetTypes = analysis->getValueTypes(newv->value);
|
||||
VarType &vt = a->varTypes[newv->slot];
|
||||
if (vt.type == JSVAL_TYPE_INT32) {
|
||||
types::TypeSet *targetTypes = analysis->getValueTypes(newv->value);
|
||||
if (targetTypes->getKnownTypeTag(cx) == JSVAL_TYPE_DOUBLE &&
|
||||
fixDoubleSlot(newv->slot)) {
|
||||
if (targetTypes->getKnownTypeTag(cx) == JSVAL_TYPE_DOUBLE &&
|
||||
fixDoubleSlot(newv->slot)) {
|
||||
FrameEntry *fe = frame.getOrTrack(newv->slot);
|
||||
if (vt.type == JSVAL_TYPE_INT32) {
|
||||
fixedDoubleEntries.append(newv->slot);
|
||||
FrameEntry *fe = frame.getOrTrack(newv->slot);
|
||||
frame.ensureDouble(fe);
|
||||
} else if (vt.type == JSVAL_TYPE_UNKNOWN) {
|
||||
/*
|
||||
* Unknown here but a double at the target. The type
|
||||
* set for the existing value must be empty, so this
|
||||
* code is doomed and we can just mark the value as
|
||||
* a double.
|
||||
*/
|
||||
frame.ensureDouble(fe);
|
||||
} else {
|
||||
JS_ASSERT(vt.type == JSVAL_TYPE_DOUBLE);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
@ -1354,10 +1354,12 @@ FrameState::assertValidRegisterState() const
|
||||
if (fe->type.inRegister()) {
|
||||
checkedFreeRegs.takeReg(fe->type.reg());
|
||||
JS_ASSERT(regstate(fe->type.reg()).fe() == fe);
|
||||
JS_ASSERT(!fe->isType(JSVAL_TYPE_DOUBLE));
|
||||
}
|
||||
if (fe->data.inRegister()) {
|
||||
checkedFreeRegs.takeReg(fe->data.reg());
|
||||
JS_ASSERT(regstate(fe->data.reg()).fe() == fe);
|
||||
JS_ASSERT(!fe->isType(JSVAL_TYPE_DOUBLE));
|
||||
}
|
||||
if (fe->data.inFPRegister()) {
|
||||
JS_ASSERT(fe->isType(JSVAL_TYPE_DOUBLE));
|
||||
|
Loading…
Reference in New Issue
Block a user