[INFER] Fix test for when double entries need to be forgotten after branching to a location their type is unknown, bug 684576.

This commit is contained in:
Brian Hackett 2011-09-05 07:29:51 -07:00
parent 2ac6308262
commit d78ee3ef8a
2 changed files with 11 additions and 1 deletions

View File

@ -0,0 +1,10 @@
// |jit-test| error: TypeError
function f0(p0,p1) {
var v3;
do {
p1 > v3
v3=1.7
} while (((p0[p1][5]==1)||(p0[p1][5]==2)||(p0[p1][5] == 3)) + 0 > p0);
+ (v3(f0));
}
f0(4105,8307);

View File

@ -7092,7 +7092,7 @@ mjit::Compiler::fixDoubleTypes(jsbytecode *target)
} else {
JS_ASSERT(vt.type == JSVAL_TYPE_DOUBLE);
}
} else if (fe->isType(JSVAL_TYPE_DOUBLE)) {
} else if (vt.type == JSVAL_TYPE_DOUBLE) {
fixedDoubleToAnyEntries.append(newv->slot);
frame.syncAndForgetFe(fe);
frame.forgetLoopReg(fe);