mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
[INFER] Assume double types for entries with empty type sets being merged into double phi nodes, bug 653249.
This commit is contained in:
parent
d868b00326
commit
052373f8bb
13
js/src/jit-test/tests/jaeger/bug653249.js
Normal file
13
js/src/jit-test/tests/jaeger/bug653249.js
Normal file
@ -0,0 +1,13 @@
|
|||||||
|
|
||||||
|
function testUnaryImacros() {
|
||||||
|
function checkArg(x) {
|
||||||
|
o = {
|
||||||
|
valueOf: checkArg
|
||||||
|
}
|
||||||
|
}
|
||||||
|
var v = 0;
|
||||||
|
v += +toString;
|
||||||
|
for (var i = 0; i;) {
|
||||||
|
v += [].checkArg.checkArg;
|
||||||
|
}
|
||||||
|
}(testUnaryImacros(), "valueOf passed, toString passed");
|
@ -7129,14 +7129,24 @@ mjit::Compiler::fixDoubleTypes(jsbytecode *target)
|
|||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
if (newv->slot < analyze::TotalSlots(script)) {
|
if (newv->slot < analyze::TotalSlots(script)) {
|
||||||
VarType &vt = a->varTypes[newv->slot];
|
|
||||||
if (vt.type == JSVAL_TYPE_INT32) {
|
|
||||||
types::TypeSet *targetTypes = analysis->getValueTypes(newv->value);
|
types::TypeSet *targetTypes = analysis->getValueTypes(newv->value);
|
||||||
|
VarType &vt = a->varTypes[newv->slot];
|
||||||
if (targetTypes->getKnownTypeTag(cx) == JSVAL_TYPE_DOUBLE &&
|
if (targetTypes->getKnownTypeTag(cx) == JSVAL_TYPE_DOUBLE &&
|
||||||
fixDoubleSlot(newv->slot)) {
|
fixDoubleSlot(newv->slot)) {
|
||||||
fixedDoubleEntries.append(newv->slot);
|
|
||||||
FrameEntry *fe = frame.getOrTrack(newv->slot);
|
FrameEntry *fe = frame.getOrTrack(newv->slot);
|
||||||
|
if (vt.type == JSVAL_TYPE_INT32) {
|
||||||
|
fixedDoubleEntries.append(newv->slot);
|
||||||
frame.ensureDouble(fe);
|
frame.ensureDouble(fe);
|
||||||
|
} else if (vt.type == JSVAL_TYPE_UNKNOWN) {
|
||||||
|
/*
|
||||||
|
* Unknown here but a double at the target. The type
|
||||||
|
* set for the existing value must be empty, so this
|
||||||
|
* code is doomed and we can just mark the value as
|
||||||
|
* a double.
|
||||||
|
*/
|
||||||
|
frame.ensureDouble(fe);
|
||||||
|
} else {
|
||||||
|
JS_ASSERT(vt.type == JSVAL_TYPE_DOUBLE);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -1354,10 +1354,12 @@ FrameState::assertValidRegisterState() const
|
|||||||
if (fe->type.inRegister()) {
|
if (fe->type.inRegister()) {
|
||||||
checkedFreeRegs.takeReg(fe->type.reg());
|
checkedFreeRegs.takeReg(fe->type.reg());
|
||||||
JS_ASSERT(regstate(fe->type.reg()).fe() == fe);
|
JS_ASSERT(regstate(fe->type.reg()).fe() == fe);
|
||||||
|
JS_ASSERT(!fe->isType(JSVAL_TYPE_DOUBLE));
|
||||||
}
|
}
|
||||||
if (fe->data.inRegister()) {
|
if (fe->data.inRegister()) {
|
||||||
checkedFreeRegs.takeReg(fe->data.reg());
|
checkedFreeRegs.takeReg(fe->data.reg());
|
||||||
JS_ASSERT(regstate(fe->data.reg()).fe() == fe);
|
JS_ASSERT(regstate(fe->data.reg()).fe() == fe);
|
||||||
|
JS_ASSERT(!fe->isType(JSVAL_TYPE_DOUBLE));
|
||||||
}
|
}
|
||||||
if (fe->data.inFPRegister()) {
|
if (fe->data.inFPRegister()) {
|
||||||
JS_ASSERT(fe->isType(JSVAL_TYPE_DOUBLE));
|
JS_ASSERT(fe->isType(JSVAL_TYPE_DOUBLE));
|
||||||
|
Loading…
Reference in New Issue
Block a user