wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 895782 - Fix callsite cloning interaction with inline dispatch in Ion redux. (r=jandem)

Browse Source
This commit is contained in:
Shu-yu Guo 2013-07-22 16:12:06 -07:00
parent 910d7fc289
commit 84f8af7a1f
2 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
js/src/ion/IonBuilder.cpp
View File

@ -4235,7 +4235,7 @@ IonBuilder::inlineCalls(CallInfo &callInfo, AutoObjectVector &targets,
//
// Note that guarding is on the original function pointer even
// if there is a clone, since cloning occurs at the callsite.
dispatch->addCase(&originals[i]->as<JSFunction>(), inlineBlock);
dispatch->addCase(original, inlineBlock);
MDefinition *retVal = inlineReturnBlock->peek(-1);
retPhi->addInput(retVal);
@ -4245,11 +4245,13 @@ IonBuilder::inlineCalls(CallInfo &callInfo, AutoObjectVector &targets,
}
// Patch the InlinePropertyTable to not dispatch to vetoed paths.
//
// Note that like above, we trim using originals instead of targets.
if (maybeCache) {
maybeCache->object()->setResultTypeSet(cacheObjectTypeSet);
InlinePropertyTable *propTable = maybeCache->propTable();
propTable->trimTo(targets, choiceSet);
propTable->trimTo(originals, choiceSet);
// If all paths were vetoed, output only a generic fallback path.
if (propTable->numEntries() == 0) {

10
js/src/jit-test/tests/parallelarray/bug895782.js Normal file
View File

@ -0,0 +1,10 @@
// Don't crash
Object.defineProperty(this, "y", {
get: function() {
return Object.create(x)
}
})
x = ParallelArray([1142], function() {})
x = x.partition(2)
y + y