Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-12-12 00:50:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1789821: Don't DCE MMinMaxArray r=jandem

Browse Source 
Differential Revision: https://phabricator.services.mozilla.com/D156881
This commit is contained in:
Iain Ireland 2022-09-09 16:21:27 +00:00
parent 98ab6b639b
commit 3c329f99d6
2 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
js/src/jit-test/tests/warp/bug1789821.js Normal file
View File

@ -0,0 +1,14 @@
function foo(x) {
Math.max(...[x]);
}
with ({}) {}
for (let i = 0; i < 100; i++) {
foo(0);
}
let called = false;
const evil = { valueOf: () => { called = true; } };
foo(evil);
assertEq(called, true);

5
js/src/jit/MIR.h
View File

@ -4430,6 +4430,11 @@ class MMinMaxArray : public MUnaryInstruction, public SingleObjectPolicy::Data {
: MUnaryInstruction(classOpcode, array), isMax_(isMax) {
MOZ_ASSERT(type == MIRType::Int32 || type == MIRType::Double);
setResultType(type);
// We can't DCE this, even if the result is unused, in case one of the
// elements of the array is an object with a `valueOf` function that
// must be called.
setGuard();
}
public: