wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 1132290 - IonMonkey: Remove indirect truncation of MLoadTypedArrayElementStatic, r=nbp

Browse Source
This commit is contained in:
Hannes Verschore 2015-02-13 10:57:26 +01:00
parent a7692466c4
commit 1e632bf60c
2 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
js/src/jit-test/tests/ion/bug1132290.js Normal file
View File

@ -0,0 +1,10 @@
f = function() {
v = Uint8Array()
function f(x) {
return x + v[0] | 0
}
return f
}()
assertEq(f(0), 0)
assertEq(f(1), 0)

5
js/src/jit/RangeAnalysis.cpp
View File

@ -2517,7 +2517,10 @@ MToDouble::truncate()
bool
MLoadTypedArrayElementStatic::needTruncation(TruncateKind kind)
{
if (kind >= IndirectTruncate)
// IndirectTruncate not possible, since it returns 'undefined'
// upon out of bounds read. Doing arithmetic on 'undefined' gives wrong
// results. So only set infallible if explicitly truncated.
if (kind == Truncate)
setInfallible();
return false;