Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-08 10:44:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1326589 - Correct CacheIR issue with uninitialized let and GetGName. r=jandem

Browse Source
This commit is contained in:
Tom Schuster 2017-01-01 15:12:17 +01:00
parent ce7d6df2ad
commit 4a85614b87
3 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
js/src/jit-test/tests/baseline/getgname-uninitialized-let.js Normal file
View File

@ -0,0 +1,8 @@
for (var i = 0; i < 12; i++) {
try {
// GetGName
void x;
} catch (e) { }
}
let x;

13
js/src/jit-test/tests/baseline/getname-uninitialized-let.js Normal file
View File

@ -0,0 +1,13 @@
function f() {
for (var i = 0; i < 12; i++) {
try {
eval("");
void x;
} catch (e) { }
}
}
f();
let x;

6
js/src/jit/CacheIR.cpp
View File

@ -1218,6 +1218,10 @@ GetNameIRGenerator::tryAttachGlobalNameValue(ObjOperandId objId, HandleId id)
if (!shape->hasDefaultGetter() || !shape->hasSlot())
return false;
// This might still be an uninitialized lexical.
if (holder->getSlot(shape->slot()).isMagic())
return false;
// Instantiate this global property, for use during Ion compilation.
if (IsIonEnabled(cx_))
EnsureTrackPropertyTypes(cx_, holder, id);
@ -1332,6 +1336,8 @@ GetNameIRGenerator::tryAttachEnvironmentName(ObjOperandId objId, HandleId id)
holder = &env->as<NativeObject>();
if (!IsCacheableGetPropReadSlotForIonOrCacheIR(holder, holder, shape))
return false;
if (holder->getSlot(shape->slot()).isMagic())
return false;
ObjOperandId lastObjId = objId;
env = env_;