Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-01 14:45:29 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1006885 - IonMonkey: Disable fastpath of bound function for constructing calls with a known non-native, r=jandem

Browse Source
This commit is contained in:
Hannes Verschore 2014-05-09 13:23:59 +02:00
parent f746967097
commit 679bd2c98f
2 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
js/src/jit-test/tests/ion/bug1006885.js Normal file
View File

@ -0,0 +1,9 @@
function checkConstruct(thing, buggy) {
try {
new thing();
} catch (e) {}
}
var boundFunctionPrototype = Function.prototype.bind();
checkConstruct(boundFunctionPrototype, true);
var boundBuiltin = Math.sin.bind();
checkConstruct(boundBuiltin, true);

9
js/src/jit/MCallOptimize.cpp
View File

@ -1918,6 +1918,15 @@ IonBuilder::inlineBoundFunction(CallInfo &nativeCallInfo, JSFunction *target)
JSFunction *scriptedTarget = &(target->getBoundFunctionTarget()->as<JSFunction>());
JSRuntime *runtime = scriptedTarget->runtimeFromMainThread();
// Don't optimize if we're constructing and the callee is not a
// constructor, so that CallKnown does not have to handle this case
// (it should always throw).
if (nativeCallInfo.constructing() && !scriptedTarget->isInterpretedConstructor() &&
!scriptedTarget->isNativeConstructor())
{
return InliningStatus_NotInlined;
}
if (gc::IsInsideNursery(runtime, scriptedTarget))
return InliningStatus_NotInlined;