mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-11-26 06:11:37 +00:00
Fix CheckSideEffects over-aggressiveness (383674, r=mrbkap).
This commit is contained in:
parent
48e93e5ace
commit
1e95e50e45
@ -2212,28 +2212,18 @@ CheckSideEffects(JSContext *cx, JSTreeContext *tc, JSParseNode *pn,
|
||||
if (!CheckSideEffects(cx, tc, pn->pn_right, answer))
|
||||
return JS_FALSE;
|
||||
if (!*answer &&
|
||||
(pn2->pn_slot < 0 || !(pn2->pn_attrs & JSPROP_READONLY))) {
|
||||
(pn->pn_op != JSOP_NOP ||
|
||||
pn2->pn_slot < 0 ||
|
||||
!(pn2->pn_attrs & JSPROP_READONLY))) {
|
||||
*answer = JS_TRUE;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
if (pn->pn_type == TOK_LB) {
|
||||
pn2 = pn->pn_left;
|
||||
if (pn2->pn_type == TOK_NAME &&
|
||||
!BindNameToSlot(cx, tc, pn2, 0)) {
|
||||
return JS_FALSE;
|
||||
}
|
||||
if (pn2->pn_op != JSOP_ARGUMENTS) {
|
||||
/*
|
||||
* Any indexed property reference could call a getter with
|
||||
* side effects, except for arguments[i] where arguments is
|
||||
* unambiguous.
|
||||
*/
|
||||
*answer = JS_TRUE;
|
||||
}
|
||||
}
|
||||
ok = CheckSideEffects(cx, tc, pn->pn_left, answer) &&
|
||||
CheckSideEffects(cx, tc, pn->pn_right, answer);
|
||||
/*
|
||||
* We can't easily prove that neither operand ever denotes an
|
||||
* object with a toString or valueOf method.
|
||||
*/
|
||||
*answer = JS_TRUE;
|
||||
}
|
||||
break;
|
||||
|
||||
@ -2266,7 +2256,11 @@ CheckSideEffects(JSContext *cx, JSTreeContext *tc, JSParseNode *pn,
|
||||
break;
|
||||
}
|
||||
} else {
|
||||
ok = CheckSideEffects(cx, tc, pn->pn_kid, answer);
|
||||
/*
|
||||
* We can't easily prove that our operand never denotes an object
|
||||
* with a toString or valueOf method.
|
||||
*/
|
||||
*answer = JS_TRUE;
|
||||
}
|
||||
break;
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user