wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

[INFER] Don't inline scripts which use 'this' and could ever be called with a 'this' value needing wrapping, bug 655954.

Browse Source
This commit is contained in:
Brian Hackett 2011-05-10 07:09:02 -07:00
parent 48d3db3956
commit b106aecd63
2 changed files with 25 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
js/src/jit-test/tests/jaeger/inline/bug655954.js Normal file
View File

@ -0,0 +1,5 @@
// |jit-test| error: TypeError
foo();
function foo() {
this();
}

23
js/src/methodjit/Compiler.cpp
View File

@ -349,6 +349,18 @@ mjit::Compiler::scanInlineCalls(uint32 index, uint32 depth)
okay = false;
break;
}
/*
* Don't inline scripts which use 'this' if it is possible they
* could be called with a 'this' value requiring wrapping. During
* inlining we do not want to modify frame entries belonging to the
* caller.
*/
if (script->analysis(cx)->usesThisValue() &&
script->thisTypes()->getKnownTypeTag(cx) != JSVAL_TYPE_OBJECT) {
okay = false;
break;
}
}
if (!okay)
continue;
@ -5116,14 +5128,19 @@ mjit::Compiler::jsop_this()
*/
if (script->fun && !script->strictModeCode) {
FrameEntry *thisFe = frame.peek(-1);
/*
* We don't inline calls to scripts which use 'this' but might require
* 'this' to be wrapped.
*/
JS_ASSERT(!thisFe->isNotType(JSVAL_TYPE_OBJECT));
if (!thisFe->isType(JSVAL_TYPE_OBJECT)) {
JSValueType type = cx->typeInferenceEnabled()
? script->thisTypes()->getKnownTypeTag(cx)
: JSVAL_TYPE_UNKNOWN;
if (type != JSVAL_TYPE_OBJECT) {
Jump notObj = thisFe->isTypeKnown()
? masm.jump()
: frame.testObject(Assembler::NotEqual, thisFe);
Jump notObj = frame.testObject(Assembler::NotEqual, thisFe);
stubcc.linkExit(notObj, Uses(1));
stubcc.leave();
OOL_STUBCALL(stubs::This, REJOIN_FALLTHROUGH);