Bug 1216130 part 2 - Add test. r=bhackett

This commit is contained in:
Jan de Mooij 2016-02-27 17:32:44 +01:00
parent 417a1b868b
commit 51f9f6a893
2 changed files with 55 additions and 0 deletions

View File

@ -0,0 +1,50 @@
function Obj1(x) { this.x = x; }
function f1() {
var arr = [], o = {};
for (var i=0; i<2500; i++) {
arr.push(new Obj1(o));
if (i < 15) {
arr[i].x = undefined;
arr[i].x = Math;
}
}
for (var i=0; i<2500; i++) {
var y = (i > 2000) ? undefined : o;
arr[i].x = y;
}
}
f1();
function f2() {
var arr = [], p = {};
for (var i=0; i<2500; i++) {
var x = (i < 2000) ? p : undefined;
var o = {x: x};
if (i < 5) {
o.x = undefined;
o.x = p;
}
arr.push(o);
}
for (var i=0; i<2500; i++) {
assertEq(arr[i].x, i < 2000 ? p : undefined);
}
}
f2();
function f3() {
var arr = [], p = {};
for (var i=0; i<2500; i++) {
var x = (i < 2000) ? p : true;
var o = {x: x};
if (i < 5) {
o.x = true;
o.x = p;
}
arr.push(o);
}
for (var i=0; i<2500; i++) {
assertEq(arr[i].x, i < 2000 ? p : true);
}
}
f3();

View File

@ -12550,6 +12550,11 @@ IonBuilder::storeUnboxedValue(MDefinition* obj, MDefinition* elements, int32_t e
break;
case JSVAL_TYPE_OBJECT:
MOZ_ASSERT(value->type() == MIRType_Object ||
value->type() == MIRType_Null ||
value->type() == MIRType_Value);
MOZ_ASSERT(!value->mightBeType(MIRType_Undefined),
"MToObjectOrNull slow path is invalid for unboxed objects");
store = MStoreUnboxedObjectOrNull::New(alloc(), elements, scaledOffset, value, obj,
elementsOffset, preBarrier);
break;