wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 995673 - IonMonkey: Don't remove MToXXX instructions, when an object flows through, r=jandem

Browse Source
This commit is contained in:
Hannes Verschore 2014-04-22 16:46:18 +02:00
parent c656fbc9fb
commit bd1059d025
2 changed files with 32 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
js/src/jit-test/tests/ion/bug995673.js Normal file
View File

@ -0,0 +1,16 @@
var total = 0
x = [ [] ]
x[0].valueOf = function () {
total++;
}
function f(y) {
y != Math.abs()
}
(function() {
f()
f(x[0])
f(x[0])
})()
assertEq(total, 2)

16
js/src/jit/MIR.h
View File

@ -2823,6 +2823,10 @@ class MToDouble
{
setResultType(MIRType_Double);
setMovable();
// An object might have "valueOf", which means it is effectful.
if (def->mightBeType(MIRType_Object))
setGuard();
}
public:
@ -2885,6 +2889,10 @@ class MToFloat32
{
setResultType(MIRType_Float32);
setMovable();
// An object might have "valueOf", which means it is effectful.
if (def->mightBeType(MIRType_Object))
setGuard();
}
public:
@ -2993,6 +3001,10 @@ class MToInt32
{
setResultType(MIRType_Int32);
setMovable();
// An object might have "valueOf", which means it is effectful.
if (def->mightBeType(MIRType_Object))
setGuard();
}
public:
@ -3047,6 +3059,10 @@ class MTruncateToInt32 : public MUnaryInstruction
{
setResultType(MIRType_Int32);
setMovable();
// An object might have "valueOf", which means it is effectful.
if (def->mightBeType(MIRType_Object))
setGuard();
}
public: