Bug 1072911 - Scalar Replacement: Add missing MIRTypes. r=h4writer
authorNicolas B. Pierron <nicolas.b.pierron@mozilla.com>
Fri, 26 Sep 2014 19:47:59 +0200
changeset 207454 11a4a935eb7d14bdcdbfdac46db1d5cd47fa4b36
parent 207453 846faaa682191cfe400dac43ff2b03b028d764be
child 207455 233cb55654a375945b8058c0b1317b57df11bb37
push id49688
push usernpierron@mozilla.com
push dateFri, 26 Sep 2014 17:48:22 +0000
treeherdermozilla-inbound@233cb55654a3 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersh4writer
bugs1072911
milestone35.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1072911 - Scalar Replacement: Add missing MIRTypes. r=h4writer
js/src/jit-test/tests/ion/bug1072911.js
js/src/jit/MIR.cpp
js/src/jit/MIR.h
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1072911.js
@@ -0,0 +1,14 @@
+
+function X () {};
+function Y () {};
+function testCallProtoMethod() {
+    var a = [new X, new X, __proto__, new Y, new Y];
+}
+testCallProtoMethod();
+
+function testNot() {
+    var r;
+    for (var i = 0; i < 10; ++i)
+        r = [];
+}
+testNot();
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -3173,16 +3173,17 @@ MCreateThisWithTemplate::canRecoverOnBai
     MOZ_ASSERT(!templateObject()->denseElementsAreCopyOnWrite());
     MOZ_ASSERT(!templateObject()->is<ArrayObject>());
     return true;
 }
 
 MObjectState::MObjectState(MDefinition *obj)
 {
     // This instruction is only used as a summary for bailout paths.
+    setResultType(MIRType_Object);
     setRecoveredOnBailout();
     JSObject *templateObject = nullptr;
     if (obj->isNewObject())
         templateObject = obj->toNewObject()->templateObject();
     else
         templateObject = obj->toCreateThisWithTemplate()->templateObject();
     numSlots_ = templateObject->slotSpan();
     numFixedSlots_ = templateObject->numFixedSlots();
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -2576,16 +2576,17 @@ class MObjectState : public MVariadicIns
 class MArrayState : public MVariadicInstruction
 {
   private:
     uint32_t numElements_;
 
     explicit MArrayState(MDefinition *arr)
     {
         // This instruction is only used as a summary for bailout paths.
+        setResultType(MIRType_Object);
         setRecoveredOnBailout();
         numElements_ = arr->toNewArray()->count();
     }
 
     bool init(TempAllocator &alloc, MDefinition *obj, MDefinition *len) {
         if (!MVariadicInstruction::init(alloc, numElements() + 2))
             return false;
         initOperand(0, obj);