wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Backed out changeset 750b497aea43 (bug 1089761) for rootanalysis orange on a CLOSED TREE

Browse Source
This commit is contained in:
Wes Kocher 2014-10-29 14:14:42 -07:00
parent 0ec2314a66
commit bada661db7
3 changed files with 3 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
js/src/jit-test/tests/ion/bug1089761.js
View File

@ -1,14 +0,0 @@
var hits = 0;
for (var j = 0; j < 9; ++j) {
try {
(function() {
(function() {
eval("x")
let x
})()
})()
} catch (e) {
hits++;
}
}
assertEq(hits, 9);

4
js/src/vm/ScopeObject-inl.h
View File

@ -57,9 +57,9 @@ inline void
CallObject::setAliasedLexicalsToThrowOnTouch(JSScript *script)
{
uint32_t aliasedLexicalBegin = script->bindings.aliasedBodyLevelLexicalBegin();
uint32_t aliasedLexicalEnd = slotSpan();
uint32_t aliasedLexicalEnd = numFixedSlots();
for (uint32_t slot = aliasedLexicalBegin; slot < aliasedLexicalEnd; slot++)
initSlot(slot, MagicValue(JS_UNINITIALIZED_LEXICAL));
initFixedSlot(slot, MagicValue(JS_UNINITIALIZED_LEXICAL));
}
template <AllowGC allowGC>

5
js/src/vm/ScopeObject.cpp
View File

@ -198,10 +198,6 @@ CallObject::createTemplateObject(JSContext *cx, HandleScript script, gc::Initial
if (!obj)
return nullptr;
// Set uninitialized lexicals even on template objects, as Ion will
// copy over the template object's slot values in the fast path.
obj->as<CallObject>().setAliasedLexicalsToThrowOnTouch(script);
return &obj->as<CallObject>();
}
@ -221,6 +217,7 @@ CallObject::create(JSContext *cx, HandleScript script, HandleObject enclosing, H
callobj->as<ScopeObject>().setEnclosingScope(enclosing);
callobj->initFixedSlot(CALLEE_SLOT, ObjectOrNullValue(callee));
callobj->setAliasedLexicalsToThrowOnTouch(script);
if (script->treatAsRunOnce()) {
Rooted<CallObject*> ncallobj(cx, callobj);