Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-24 21:31:04 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1472132 - Don't inline non-scripted functions in Ion when constructing and new.target != the callee. r=anba

Browse Source
This commit is contained in:
Jan de Mooij 2018-07-02 18:34:02 +02:00
parent 2f36e69ffe
commit a94a5f8023
3 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
js/public/TrackedOptimizationInfo.h
View File

@ -208,6 +208,7 @@ namespace JS {
_(CantInlineNativeNoTemplateObj) \
_(CantInlineBound) \
_(CantInlineNativeNoSpecialization) \
_(CantInlineUnexpectedNewTarget) \
_(HasCommonInliningPath) \
\
_(GenericSuccess) \

11
js/src/jit-test/tests/ion/bug1472132.js Normal file
View File

@ -0,0 +1,11 @@
function f() {
for (var i = 0; i < 1200; i++) {
var o1 = Reflect.construct(Array, [], Object);
var o2 = Reflect.construct(String, [""], Object);
var o3 = Reflect.construct(Int32Array, [0], Object);
assertEq(o1.__proto__, Object.prototype);
assertEq(o2.__proto__, Object.prototype);
assertEq(o3.__proto__, Object.prototype);
}
}
f();

14
js/src/jit/MCallOptimize.cpp
View File

@ -65,6 +65,13 @@ IonBuilder::inlineNativeCall(CallInfo& callInfo, JSFunction* target)
return InliningStatus_NotInlined;
}
// Don't inline if we're constructing and new.target != callee. This can
// happen with Reflect.construct or derived class constructors.
if (callInfo.constructing() && callInfo.getNewTarget() != callInfo.fun()) {
trackOptimizationOutcome(TrackedOutcome::CantInlineUnexpectedNewTarget);
return InliningStatus_NotInlined;
}
// Default failure reason is observing an unsupported type.
trackOptimizationOutcome(TrackedOutcome::CantInlineNativeBadType);
@ -462,6 +469,13 @@ IonBuilder::inlineNonFunctionCall(CallInfo& callInfo, JSObject* target)
MOZ_ASSERT(target->nonCCWRealm() == script()->realm());
// Don't inline if we're constructing and new.target != callee. This can
// happen with Reflect.construct or derived class constructors.
if (callInfo.constructing() && callInfo.getNewTarget() != callInfo.fun()) {
trackOptimizationOutcome(TrackedOutcome::CantInlineUnexpectedNewTarget);
return InliningStatus_NotInlined;
}
if (callInfo.constructing() && target->constructHook() == TypedObject::construct)
return inlineConstructTypedObject(callInfo, &target->as<TypeDescr>());