Check that double variables have the correct representation when changing types at switch targets, bug 751320. r=dvander

This commit is contained in:
Brian Hackett 2012-05-05 07:18:55 -07:00
parent edbe43b288
commit 0b49a55227
2 changed files with 44 additions and 0 deletions

View File

@ -0,0 +1,22 @@
datediff = function(date1, date2, interval) {
var delta = 1;
switch(interval) {
case "day":
delta /= 24;
case "hour":
delta /= 60;
case "minute":
delta /= 60;
case "second":
delta /= 1000;
case "millisecond":
delta *= date2.getTime() - date1.getTime();
}
return Math.round(delta);
};
var diff = datediff(new Date("2012-04-28T14:30:00Z"), new Date("2012-04-29T14:30:00Z"), "day");
for (var i = 0; i < 50; i++) {
diff = datediff(new Date("2012-04-28T17:00:00Z"), new Date("2012-04-28T17:30:00Z"), "minute");
assertEq(diff, 30);
}

View File

@ -2067,6 +2067,28 @@ mjit::Compiler::generateMethod()
frame.assertValidRegisterState();
a->jumpMap[uint32_t(PC - script->code)] = masm.label();
if (cx->typeInferenceEnabled() && opinfo->safePoint) {
/*
* We may have come in from a table switch, which does not watch
* for the new types introduced for variables at each dispatch
* target. Make sure that new SSA values at this safe point with
* double type have the correct in memory representation.
*/
const SlotValue *newv = analysis->newValues(PC);
if (newv) {
while (newv->slot) {
if (newv->value.kind() == SSAValue::PHI &&
newv->value.phiOffset() == uint32_t(PC - script->code) &&
analysis->trackSlot(newv->slot) &&
a->varTypes[newv->slot].getTypeTag(cx) == JSVAL_TYPE_DOUBLE) {
FrameEntry *fe = frame.getSlotEntry(newv->slot);
masm.ensureInMemoryDouble(frame.addressOf(fe));
}
newv++;
}
}
}
// Now that we have the PC's register allocation, make sure it gets
// explicitly updated if this is the loop entry and new loop registers
// are allocated later on.