Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-12 12:55:46 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 843875 - Don't use converted value for result of array assigns that require double conversion, r=jandem.

Browse Source
This commit is contained in:
Brian Hackett 2013-02-22 16:58:31 -07:00
parent dba3797c2c
commit 56f63d1f20
2 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
js/src/ion/IonBuilder.cpp
View File

@ -5871,10 +5871,11 @@ IonBuilder::jsop_setelem_dense()
id = idInt32;
// Ensure the value is a double, if double conversion might be needed.
MDefinition *newValue = value;
if (oracle->elementWriteNeedsDoubleConversion(script(), pc)) {
MInstruction *valueDouble = MToDouble::New(value);
current->add(valueDouble);
value = valueDouble;
newValue = valueDouble;
}
// Get the elements vector.
@ -5886,7 +5887,7 @@ IonBuilder::jsop_setelem_dense()
// the initialized length and bounds check.
MStoreElementCommon *store;
if (oracle->setElementHasWrittenHoles(script(), pc) && writeOutOfBounds) {
MStoreElementHole *ins = MStoreElementHole::New(obj, elements, id, value);
MStoreElementHole *ins = MStoreElementHole::New(obj, elements, id, newValue);
store = ins;
current->add(ins);
@ -5902,7 +5903,7 @@ IonBuilder::jsop_setelem_dense()
bool needsHoleCheck = !packed && !writeOutOfBounds;
MStoreElement *ins = MStoreElement::New(elements, id, value, needsHoleCheck);
MStoreElement *ins = MStoreElement::New(elements, id, newValue, needsHoleCheck);
store = ins;
current->add(ins);

8
js/src/jit-test/tests/ion/bug843875.js Normal file
View File

@ -0,0 +1,8 @@
function writeHeaderToLog( string ) { }
var input = [ 0xfffffff0, 101 ];
var arr = new Uint32Array(input.length);
var expected = [ 0xffffffff, 101 ];
for (var i=0; i<arr.length; i++) {
arr[i] = writeHeaderToLog[i] = expected[i] = i * 8;
}