Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-28 23:31:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1240100: IonMonkey: Magic values cannot flow through an instruction, r=jandem

Browse Source
This commit is contained in:
Hannes Verschore 2016-01-22 04:13:01 -05:00
parent 4611d1696c
commit 85e8ee8ba6
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
js/src/jit/IonBuilder.cpp
View File

@ -3554,8 +3554,12 @@ IonBuilder::replaceTypeSet(MDefinition* subject, TemporaryTypeSet* type, MTest*
if (ins->type() == MIRType_Undefined)
current->setSlot(i, constant(UndefinedValue()));
if (ins->type() == MIRType_Null)
else if (ins->type() == MIRType_Null)
current->setSlot(i, constant(NullValue()));
else if (ins->type() == MIRType_MagicOptimizedArguments)
current->setSlot(i, constant(MagicValue(JS_OPTIMIZED_ARGUMENTS)));
else
MOZ_ASSERT(!IsMagicType(ins->type()));
continue;
}
@ -3575,8 +3579,12 @@ IonBuilder::replaceTypeSet(MDefinition* subject, TemporaryTypeSet* type, MTest*
if (replace->type() == MIRType_Undefined)
replace = constant(UndefinedValue());
if (replace->type() == MIRType_Null)
else if (replace->type() == MIRType_Null)
replace = constant(NullValue());
else if (replace->type() == MIRType_MagicOptimizedArguments)
replace = constant(MagicValue(JS_OPTIMIZED_ARGUMENTS));
else
MOZ_ASSERT(!IsMagicType(ins->type()));
}
current->setSlot(i, replace);
}