wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 1140888 - Make sure Ion code depending on unboxed layouts is invalidated when unboxed objects are converted to natives, r=jandem.

Browse Source
This commit is contained in:
Brian Hackett 2015-03-09 09:17:27 -06:00
parent 756095d1ec
commit d47ad735ea
2 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
js/src/jit-test/tests/ion/unboxed-objects-invalidate.js Normal file
View File

@ -0,0 +1,16 @@
var a = [];
for (var i = 0; i < 2000; i++)
a.push({f:i});
function f() {
var total = 0;
for (var i = 0; i < a.length; i++)
total += a[i].f;
return total;
}
assertEq(f(), 1999000);
var sub = Object.create(a[0]);
assertEq(f(), 1999000);

2
js/src/vm/UnboxedObject.cpp
View File

@ -265,6 +265,8 @@ UnboxedLayout::makeNativeGroup(JSContext *cx, ObjectGroup *group)
nativeGroup->setOriginalUnboxedGroup(group);
group->markStateChange(cx);
return true;
}