wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 762105 - Fix increment on formal parameters aliased by the arguments object (r=dvander)

Browse Source
This commit is contained in:
Luke Wagner 2012-06-07 02:42:56 -07:00
parent 5571c78064
commit e405c2f8d2
2 changed files with 50 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
js/src/jit-test/tests/basic/testBug762105.js Normal file
View File

@ -0,0 +1,33 @@
function escapeme() {}
function f1(x) {
escapeme(arguments);
var y = ++x;
return x + y;
}
for (var i = 0; i < 100; ++i)
assertEq(f1(2), 6);
function f2(x) {
escapeme(arguments);
var y = --x;
return x + y;
}
for (var i = 0; i < 100; ++i)
assertEq(f2(2), 2);
function f3(x) {
escapeme(arguments);
var y = x++;
return x + y;
}
for (var i = 0; i < 100; ++i)
assertEq(f3(2), 5);
function f4(x) {
escapeme(arguments);
var y = x--;
return x + y;
}
for (var i = 0; i < 100; ++i)
assertEq(f4(2), 3);

21
js/src/methodjit/FastOps.cpp
View File

@ -960,7 +960,10 @@ mjit::Compiler::jsop_arginc(JSOp op, uint32_t slot)
if (!analysis->incrementInitialValueObserved(PC)) {
// Before:
// After: V
frame.pushArg(slot);
if (script->argsObjAliasesFormals())
jsop_aliasedArg(slot, /* get = */ true);
else
frame.pushArg(slot);
// Before: V
// After: V 1
@ -974,11 +977,18 @@ mjit::Compiler::jsop_arginc(JSOp op, uint32_t slot)
// Before: N+1
// After: N+1
frame.storeArg(slot, analysis->popGuaranteed(PC));
bool popGuaranteed = analysis->popGuaranteed(PC);
if (script->argsObjAliasesFormals())
jsop_aliasedArg(slot, /* get = */ false, popGuaranteed);
else
frame.storeArg(slot, popGuaranteed);
} else {
// Before:
// After: V
frame.pushArg(slot);
if (script->argsObjAliasesFormals())
jsop_aliasedArg(slot, /* get = */ true);
else
frame.pushArg(slot);
// Before: V
// After: N
@ -999,7 +1009,10 @@ mjit::Compiler::jsop_arginc(JSOp op, uint32_t slot)
// Before: N N+1
// After: N N+1
frame.storeArg(slot, true);
if (script->argsObjAliasesFormals())
jsop_aliasedArg(slot, /* get = */ false, true);
else
frame.storeArg(slot, true);
// Before: N N+1
// After: N