Bug 1135723 - Traverse layout properties instead of object group properties in makeNativeGroup, handle int32->double coercion in ensureDefiniteType, r=jandem.

This commit is contained in:
Brian Hackett 2015-02-25 09:29:36 -06:00
parent 8d06e45b3d
commit d3a4d0e95a
2 changed files with 18 additions and 11 deletions

View File

@ -7112,6 +7112,10 @@ IonBuilder::ensureDefiniteType(MDefinition *def, MIRType definiteType)
default: { default: {
if (def->type() != MIRType_Value) { if (def->type() != MIRType_Value) {
if (def->type() == MIRType_Int32 && definiteType == MIRType_Double) {
replace = MToDouble::New(alloc(), def);
break;
}
MOZ_ASSERT(def->type() == definiteType); MOZ_ASSERT(def->type() == definiteType);
return def; return def;
} }

View File

@ -243,17 +243,20 @@ UnboxedLayout::makeNativeGroup(JSContext *cx, ObjectGroup *group)
return false; return false;
// Propagate all property types from the old group to the new group. // Propagate all property types from the old group to the new group.
for (size_t i = 0; i < group->getPropertyCount(); i++) { for (size_t i = 0; i < layout.properties().length(); i++) {
if (ObjectGroup::Property *property = group->getProperty(i)) { const UnboxedLayout::Property &property = layout.properties()[i];
TypeSet::TypeList types; jsid id = NameToId(property.name);
if (!property->types.enumerateTypes(&types))
return false; HeapTypeSet *typeProperty = group->maybeGetProperty(id);
for (size_t j = 0; j < types.length(); j++) TypeSet::TypeList types;
AddTypePropertyId(cx, nativeGroup, property->id, types[j]); if (!typeProperty->enumerateTypes(&types))
HeapTypeSet *nativeProperty = nativeGroup->maybeGetProperty(property->id); return false;
if (nativeProperty->canSetDefinite(i)) MOZ_ASSERT(!types.empty());
nativeProperty->setDefinite(i); for (size_t j = 0; j < types.length(); j++)
} AddTypePropertyId(cx, nativeGroup, id, types[j]);
HeapTypeSet *nativeProperty = nativeGroup->maybeGetProperty(id);
if (nativeProperty->canSetDefinite(i))
nativeProperty->setDefinite(i);
} }
layout.nativeGroup_ = nativeGroup; layout.nativeGroup_ = nativeGroup;