[INFER] Always emit jsop_getprop stub calls for rejoining in JSOP_INSTANCEOF, bug 647532.

This commit is contained in:
Brian Hackett 2011-04-03 11:16:44 -07:00
parent 8b7888dd66
commit 1ed19456f6
2 changed files with 7 additions and 6 deletions

View File

@ -0,0 +1,4 @@
try { Function("\
__defineSetter__(\"x\",Object.keys)\
(z=x instanceof[].some)\
")() } catch (e) { }

View File

@ -6020,12 +6020,9 @@ mjit::Compiler::jsop_instanceof()
// The fast path applies only when both operands are objects. // The fast path applies only when both operands are objects.
if (rhs->isNotType(JSVAL_TYPE_OBJECT) || lhs->isNotType(JSVAL_TYPE_OBJECT)) { if (rhs->isNotType(JSVAL_TYPE_OBJECT) || lhs->isNotType(JSVAL_TYPE_OBJECT)) {
prepareStubCall(Uses(2)); stubcc.linkExit(masm.jump(), Uses(2));
INLINE_STUBCALL(stubs::InstanceOf); frame.discardFe(lhs);
frame.popn(2); frame.discardFe(rhs);
frame.takeReg(Registers::ReturnReg);
frame.pushTypedPayload(JSVAL_TYPE_BOOLEAN, Registers::ReturnReg);
return true;
} }
MaybeJump firstSlow; MaybeJump firstSlow;