Bug 940846: MArrayPush shouldn't take a Float32 as an input; r=sstangl

This commit is contained in:
Benjamin Bouvier 2013-11-22 15:32:16 +01:00
parent 8410b3b034
commit 63c59d61ce
2 changed files with 16 additions and 1 deletions

View File

@ -0,0 +1,15 @@
function a(f, i) {
results = []
for (var k = 0; k < 10; ++k) {
gc();
try {
results.push(f(i[k]));
} catch (e) {
results.push(e);
}
}
}
g = (function(x, y) {
return Math.fround((x ? Math.f : m0) ? w : Math.fround())
})
a(g, [Number.MAX_VALUE])

View File

@ -5789,7 +5789,7 @@ class MArrayPopShift
// Array.prototype.push on a dense array. Returns the new array length.
class MArrayPush
: public MBinaryInstruction,
public SingleObjectPolicy
public MixPolicy<SingleObjectPolicy, NoFloatPolicy<1> >
{
MArrayPush(MDefinition *object, MDefinition *value)
: MBinaryInstruction(object, value)