mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
Bug 762105 - Fix increment on formal parameters aliased by the arguments object (r=dvander)
This commit is contained in:
parent
13b33a03ed
commit
fd5e3403c6
33
js/src/jit-test/tests/basic/testBug762105.js
Normal file
33
js/src/jit-test/tests/basic/testBug762105.js
Normal file
@ -0,0 +1,33 @@
|
||||
function escapeme() {}
|
||||
|
||||
function f1(x) {
|
||||
escapeme(arguments);
|
||||
var y = ++x;
|
||||
return x + y;
|
||||
}
|
||||
for (var i = 0; i < 100; ++i)
|
||||
assertEq(f1(2), 6);
|
||||
|
||||
function f2(x) {
|
||||
escapeme(arguments);
|
||||
var y = --x;
|
||||
return x + y;
|
||||
}
|
||||
for (var i = 0; i < 100; ++i)
|
||||
assertEq(f2(2), 2);
|
||||
|
||||
function f3(x) {
|
||||
escapeme(arguments);
|
||||
var y = x++;
|
||||
return x + y;
|
||||
}
|
||||
for (var i = 0; i < 100; ++i)
|
||||
assertEq(f3(2), 5);
|
||||
|
||||
function f4(x) {
|
||||
escapeme(arguments);
|
||||
var y = x--;
|
||||
return x + y;
|
||||
}
|
||||
for (var i = 0; i < 100; ++i)
|
||||
assertEq(f4(2), 3);
|
@ -960,7 +960,10 @@ mjit::Compiler::jsop_arginc(JSOp op, uint32_t slot)
|
||||
if (!analysis->incrementInitialValueObserved(PC)) {
|
||||
// Before:
|
||||
// After: V
|
||||
frame.pushArg(slot);
|
||||
if (script->argsObjAliasesFormals())
|
||||
jsop_aliasedArg(slot, /* get = */ true);
|
||||
else
|
||||
frame.pushArg(slot);
|
||||
|
||||
// Before: V
|
||||
// After: V 1
|
||||
@ -974,11 +977,18 @@ mjit::Compiler::jsop_arginc(JSOp op, uint32_t slot)
|
||||
|
||||
// Before: N+1
|
||||
// After: N+1
|
||||
frame.storeArg(slot, analysis->popGuaranteed(PC));
|
||||
bool popGuaranteed = analysis->popGuaranteed(PC);
|
||||
if (script->argsObjAliasesFormals())
|
||||
jsop_aliasedArg(slot, /* get = */ false, popGuaranteed);
|
||||
else
|
||||
frame.storeArg(slot, popGuaranteed);
|
||||
} else {
|
||||
// Before:
|
||||
// After: V
|
||||
frame.pushArg(slot);
|
||||
if (script->argsObjAliasesFormals())
|
||||
jsop_aliasedArg(slot, /* get = */ true);
|
||||
else
|
||||
frame.pushArg(slot);
|
||||
|
||||
// Before: V
|
||||
// After: N
|
||||
@ -999,7 +1009,10 @@ mjit::Compiler::jsop_arginc(JSOp op, uint32_t slot)
|
||||
|
||||
// Before: N N+1
|
||||
// After: N N+1
|
||||
frame.storeArg(slot, true);
|
||||
if (script->argsObjAliasesFormals())
|
||||
jsop_aliasedArg(slot, /* get = */ false, true);
|
||||
else
|
||||
frame.storeArg(slot, true);
|
||||
|
||||
// Before: N N+1
|
||||
// After: N
|
||||
|
Loading…
Reference in New Issue
Block a user