wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

[INFER] Compiler types should reflect inferred types for JSOP_THIS in scripts which have not executed, bug 684084.

Browse Source
This commit is contained in:
Brian Hackett 2011-09-04 13:33:04 -07:00
parent 59c6ee6694
commit 4c2126dce8
4 changed files with 33 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
js/src/jit-test/tests/jaeger/bug684084.js Normal file
View File

@ -0,0 +1,7 @@
// |jit-test| error: TypeError
function Integer( value, exception ) {
try { } catch ( e ) { }
new (value = this)( this.value );
if ( Math.floor(value) != value || isNaN(value) ) { }
}
new Integer( 3, false );

15
js/src/methodjit/Compiler.cpp
View File

@ -2740,9 +2740,8 @@ mjit::Compiler::generateMethod()
END_CASE(JSOP_UNBRAND)
BEGIN_CASE(JSOP_UNBRANDTHIS)
jsop_this();
jsop_unbrand();
frame.pop();
prepareStubCall(Uses(1));
INLINE_STUBCALL(stubs::UnbrandThis, REJOIN_FALLTHROUGH);
END_CASE(JSOP_UNBRANDTHIS)
BEGIN_CASE(JSOP_GETGLOBAL)
@ -5577,6 +5576,16 @@ mjit::Compiler::jsop_this()
stubcc.rejoin(Changes(1));
}
/*
* Watch out for an obscure case where we don't know we are pushing
* an object: the script has not yet had a 'this' value assigned,
* so no pushed 'this' type has been inferred. Don't mark the type
* as known in this case, preserving the invariant that compiler
* types reflect inferred types.
*/
if (cx->typeInferenceEnabled() && knownPushedType(0) != JSVAL_TYPE_OBJECT)
return;
// Now we know that |this| is an object.
frame.pop();
frame.learnThisIsObject(type != JSVAL_TYPE_OBJECT);

13
js/src/methodjit/StubCalls.cpp
View File

@ -2195,6 +2195,19 @@ stubs::Unbrand(VMFrame &f)
obj->unbrand(f.cx);
}
void JS_FASTCALL
stubs::UnbrandThis(VMFrame &f)
{
if (!ComputeThis(f.cx, f.fp()))
THROW();
Value &thisv = f.fp()->thisValue();
if (!thisv.isObject())
return;
JSObject *obj = &thisv.toObject();
if (obj->isNative())
obj->unbrand(f.cx);
}
void JS_FASTCALL
stubs::Pos(VMFrame &f)
{

1
js/src/methodjit/StubCalls.h
View File

@ -200,6 +200,7 @@ JSBool JS_FASTCALL InstanceOf(VMFrame &f);
void JS_FASTCALL FastInstanceOf(VMFrame &f);
void JS_FASTCALL ArgCnt(VMFrame &f);
void JS_FASTCALL Unbrand(VMFrame &f);
void JS_FASTCALL UnbrandThis(VMFrame &f);
/*
* Helper for triggering recompilation should a name read miss a type barrier,