wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 1215600 - Make IonBuilder::testGlobalLexicalBinding() work if there's no type information r=shu

Browse Source
This commit is contained in:
Jon Coppeard 2016-01-20 10:13:14 +00:00
parent a26f8fc5cc
commit 4650d6b70f
2 changed files with 48 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
js/src/jit-test/tests/ion/bug1215600.js Normal file
View File

@ -0,0 +1,23 @@
lfcode = Array()
lfcode.push("5")
lfcode.push("")
lfcode.push("3")
lfcode.push("oomTest(()=>{gc()})")
for (let i = 0; i < 10; i++) {
file = lfcode.shift()
loadFile(file)
}
function loadFile(lfVarx) {
try {
if (lfVarx.length != 1)
switch (lfRunTypeId) {
case 3:
function newFunc(x) Function(x)()
newFunc(lfVarx)
case 5:
for (lfLocal in this);
}
isNaN();
lfRunTypeId = parseInt(lfVarx);
} catch (lfVare) {}
}

45
js/src/jit/IonBuilder.cpp
View File

@ -8298,27 +8298,32 @@ IonBuilder::testGlobalLexicalBinding(PropertyName* name)
jsid id = NameToId(name);
if (analysisContext)
lexicalKey->ensureTrackedProperty(analysisContext, id);
if (!lexicalKey->unknownProperties()) {
// If the property is not found on the global lexical scope but it is
// found on the global and is configurable, freeze the typeset for its
// non-existence.
//
// In the case that it is found on the global but is non-configurable,
// the binding cannot be shadowed by a global lexical binding.
HeapTypeSetKey lexicalProperty = lexicalKey->property(id);
Shape* shape = obj->lookupPure(name);
if (shape) {
if ((JSOp(*pc) != JSOP_GETGNAME && !shape->writable()) ||
obj->getSlot(shape->slot()).isMagic(JS_UNINITIALIZED_LEXICAL))
{
return nullptr;
}
} else {
shape = script()->global().lookupPure(name);
if (!shape || shape->configurable())
MOZ_ALWAYS_FALSE(lexicalProperty.isOwnProperty(constraints()));
obj = &script()->global();
// If the property is not found on the global lexical scope but it is found
// on the global and is configurable, try to freeze the typeset for its
// non-existence. If we don't have type information then fail.
//
// In the case that it is found on the global but is non-configurable,
// the binding cannot be shadowed by a global lexical binding.
Maybe<HeapTypeSetKey> lexicalProperty;
if (!lexicalKey->unknownProperties())
lexicalProperty.emplace(lexicalKey->property(id));
Shape* shape = obj->lookupPure(name);
if (shape) {
if ((JSOp(*pc) != JSOP_GETGNAME && !shape->writable()) ||
obj->getSlot(shape->slot()).isMagic(JS_UNINITIALIZED_LEXICAL))
{
return nullptr;
}
} else {
shape = script()->global().lookupPure(name);
if (!shape || shape->configurable()) {
if (lexicalProperty.isSome())
MOZ_ALWAYS_FALSE(lexicalProperty->isOwnProperty(constraints()));
else
return nullptr;
}
obj = &script()->global();
}
return obj;