Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-08 12:37:37 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

[INFER] Fix bogus assert when restoring analysis types, bug 642254.

Browse Source
This commit is contained in:
Brian Hackett 2011-03-17 11:54:06 -07:00
parent 2816a7707c
commit b875c13ba0
2 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
js/src/jit-test/tests/basic/bug642254.js Normal file
View File

@ -0,0 +1,4 @@
function f(i) {
for (var n = 0; n < 0; n = i) { }
}
actual = f(.5);

10
js/src/methodjit/Compiler.cpp
View File

@ -5704,16 +5704,18 @@ mjit::Compiler::restoreAnalysisTypes(uint32 stackDepth)
JSValueType type = knownLocalType(i);
if (type != JSVAL_TYPE_UNKNOWN && (type != JSVAL_TYPE_DOUBLE || !analysis->localEscapes(i))) {
FrameEntry *fe = frame.getLocal(i);
JS_ASSERT(!fe->isTypeKnown());
frame.learnType(fe, type, false);
JS_ASSERT_IF(fe->isTypeKnown(), fe->isType(type));
if (!fe->isTypeKnown())
frame.learnType(fe, type, false);
}
}
for (uint32 i = 0; fun && i < fun->nargs; i++) {
JSValueType type = knownArgumentType(i);
if (type != JSVAL_TYPE_UNKNOWN && (type != JSVAL_TYPE_DOUBLE || !analysis->argEscapes(i))) {
FrameEntry *fe = frame.getArg(i);
JS_ASSERT(!fe->isTypeKnown());
frame.learnType(fe, type, false);
JS_ASSERT_IF(fe->isTypeKnown(), fe->isType(type));
if (!fe->isTypeKnown())
frame.learnType(fe, type, false);
}
}
}