mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
[INFER] Watch out for Invoke called on dummy frames when deciding to use a new type for the result, bug 653262.
This commit is contained in:
parent
052373f8bb
commit
f6366f7596
6
js/src/jit-test/tests/basic/bug653262.js
Normal file
6
js/src/jit-test/tests/basic/bug653262.js
Normal file
@ -0,0 +1,6 @@
|
||||
var HAVE_TM = 'tracemonkey' in this;
|
||||
var HOTLOOP = HAVE_TM ? tracemonkey : 8;
|
||||
with(evalcx(''))(function eval() {}, this.__defineGetter__("x", Function));
|
||||
var i = 0;
|
||||
var o;
|
||||
new(x);
|
@ -656,7 +656,7 @@ Invoke(JSContext *cx, const CallArgs &argsRef, ConstructOption option)
|
||||
JSScript *script = fun->script();
|
||||
if (JS_UNLIKELY(script->isEmpty())) {
|
||||
if (option == INVOKE_CONSTRUCTOR) {
|
||||
bool newType = cx->typeInferenceEnabled() &&
|
||||
bool newType = cx->typeInferenceEnabled() && cx->fp()->isScriptFrame() &&
|
||||
UseNewType(cx, cx->fp()->script(), cx->regs().pc);
|
||||
JSObject *obj = js_CreateThisForFunction(cx, &callee, newType);
|
||||
if (!obj)
|
||||
|
Loading…
Reference in New Issue
Block a user