Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-10 20:05:49 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 847412 - Monitor result type after a direct eval from Ion code, r=jandem.

Browse Source
This commit is contained in:
Brian Hackett 2013-03-19 08:47:06 -06:00
parent c1883f3027
commit 9eb583de8e
2 changed files with 23 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
js/src/ion/IonBuilder.cpp
View File

@ -4469,7 +4469,10 @@ IonBuilder::jsop_eval(uint32_t argc)
MInstruction *ins = MCallDirectEval::New(scopeChain, string, thisValue);
current->add(ins);
current->push(ins);
return resumeAfter(ins);
types::StackTypeSet *barrier;
types::StackTypeSet *types = oracle->returnTypeSet(script(), pc, &barrier);
return resumeAfter(ins) && pushTypeBarrier(ins, types, barrier);
}
return jsop_call(argc, /* constructing = */ false);

19
js/src/jit-test/tests/ion/bug847412.js Normal file
View File

@ -0,0 +1,19 @@
var gTestcases = new Array();
var gTc = gTestcases.length;
function TestCase( a) {
this.actual = a;
gTestcases[gTc++] = this;
}
function test() {
for ( gTc=0; gTc < gTestcases.length; gTc++ ) {
gTestcases[gTc].actual.toString()
}
}
function testOverwritingSparseHole() {
for (var i = 0; i < 50; i++)
new TestCase(eval("VAR1 = 0; VAR2 = -1; VAR1 %= VAR2; VAR1"));
}
testOverwritingSparseHole();
test();
this.toSource();