wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 921035 - Dont phi-eliminate scopeChain object in heavyweight functions if it may be neede for argsobj construction later. r=h4writer

Browse Source
This commit is contained in:
Kannan Vijayan 2013-10-16 16:20:10 -04:00
parent e36b5c1666
commit 17b3325cdc
2 changed files with 26 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
js/src/jit-test/tests/ion/bug921035.js Normal file
View File

@ -0,0 +1,14 @@
// |jit-test| error: TypeError
function $ERROR() {}
function testMultipleArgumentsObjects() {
var testargs = arguments;
var f = function (which) {
var args = [ testargs ];
return args[which][0];
};
var arr = [0, 0, 0, 0, 1];
for (var i = 0; i < arr.length; i++)
$ERROR[i] = f(arr[i]);
}
testMultipleArgumentsObjects()

15
js/src/jit/IonAnalysis.cpp
View File

@ -211,16 +211,25 @@ IsPhiObservable(MPhi *phi, Observability observe)
break;
}
// If the Phi is of the |this| value, it must always be observable.
uint32_t slot = phi->slot();
CompileInfo &info = phi->block()->info();
if (info.fun() && slot == info.thisSlot())
JSFunction *fun = info.fun();
// If the Phi is of the |this| value, it must always be observable.
if (fun && slot == info.thisSlot())
return true;
// If the function is heavyweight, and the Phi is of the |scopeChain|
// value, and the function may need an arguments object, then make sure
// to preserve the scope chain, because it may be needed to construct the
// arguments object during bailout.
if (fun && fun->isHeavyweight() && info.hasArguments() && slot == info.scopeChainSlot())
return true;
// If the Phi is one of the formal argument, and we are using an argument
// object in the function. The phi might be observable after a bailout.
// For inlined frames this is not needed, as they are captured in the inlineResumePoint.
if (info.fun() && info.hasArguments()) {
if (fun && info.hasArguments()) {
uint32_t first = info.firstArgSlot();
if (first <= slot && slot - first < info.nargs()) {
// If arguments obj aliases formals, then the arg slots will never be used.