Bug 1135723 - Traverse layout properties instead of object group properties in makeNativeGroup, handle int32->double coercion in ensureDefiniteType, r=jandem.

This commit is contained in:
Brian Hackett 2015-02-25 09:29:36 -06:00
parent 8d06e45b3d
commit d3a4d0e95a
2 changed files with 18 additions and 11 deletions

View File

@ -7112,6 +7112,10 @@ IonBuilder::ensureDefiniteType(MDefinition *def, MIRType definiteType)
default: {
if (def->type() != MIRType_Value) {
if (def->type() == MIRType_Int32 && definiteType == MIRType_Double) {
replace = MToDouble::New(alloc(), def);
break;
}
MOZ_ASSERT(def->type() == definiteType);
return def;
}

View File

@ -243,17 +243,20 @@ UnboxedLayout::makeNativeGroup(JSContext *cx, ObjectGroup *group)
return false;
// Propagate all property types from the old group to the new group.
for (size_t i = 0; i < group->getPropertyCount(); i++) {
if (ObjectGroup::Property *property = group->getProperty(i)) {
TypeSet::TypeList types;
if (!property->types.enumerateTypes(&types))
return false;
for (size_t j = 0; j < types.length(); j++)
AddTypePropertyId(cx, nativeGroup, property->id, types[j]);
HeapTypeSet *nativeProperty = nativeGroup->maybeGetProperty(property->id);
if (nativeProperty->canSetDefinite(i))
nativeProperty->setDefinite(i);
}
for (size_t i = 0; i < layout.properties().length(); i++) {
const UnboxedLayout::Property &property = layout.properties()[i];
jsid id = NameToId(property.name);
HeapTypeSet *typeProperty = group->maybeGetProperty(id);
TypeSet::TypeList types;
if (!typeProperty->enumerateTypes(&types))
return false;
MOZ_ASSERT(!types.empty());
for (size_t j = 0; j < types.length(); j++)
AddTypePropertyId(cx, nativeGroup, id, types[j]);
HeapTypeSet *nativeProperty = nativeGroup->maybeGetProperty(id);
if (nativeProperty->canSetDefinite(i))
nativeProperty->setDefinite(i);
}
layout.nativeGroup_ = nativeGroup;