Bug 1133389 - Fix FrameIter::matchCallee to consider all inner functions and not only lambdas. r=shu
authorNicolas B. Pierron <nicolas.b.pierron@mozilla.com>
Fri, 13 Mar 2015 16:14:03 +0100
changeset 233561 f0f3cba361d1cc2ae315b440ba9c7fe05275eff4
parent 233560 af8b6c7b05f8a3ce7898a83d788a080b0c0466de
child 233562 56da5d401fe2b13af17c353350ea3729d8018419
push id28417
push userryanvm@gmail.com
push dateFri, 13 Mar 2015 19:52:44 +0000
treeherdermozilla-central@977add19414a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersshu
bugs1133389
milestone39.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1133389 - Fix FrameIter::matchCallee to consider all inner functions and not only lambdas. r=shu
js/src/jit-test/tests/ion/recover-lambdas-bug1133389.js
js/src/vm/Stack.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/recover-lambdas-bug1133389.js
@@ -0,0 +1,17 @@
+var o = {}
+Object.defineProperty(o, "p", {
+    get: function() {
+        return arguments.callee.caller.caller;
+    }
+});
+
+function f() {
+    function g() {
+        return o.p;
+    }
+    return g();
+}
+
+for (var k = 0; k < 2; k++) {
+    assertEq(f(), f);
+}
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@@ -1103,22 +1103,16 @@ FrameIter::matchCallee(JSContext *cx, Ha
     // template from which it would be cloned, we compare properties which are
     // stable across the cloning of JSFunctions.
     if (((currentCallee->flags() ^ fun->flags()) & JSFunction::STABLE_ACROSS_CLONES) != 0 ||
         currentCallee->nargs() != fun->nargs())
     {
         return false;
     }
 
-    // Only some lambdas are optimized in a way which cannot be recovered without
-    // invalidating the frame. Thus, if one of the function is not a lambda we can just
-    // compare it against the calleeTemplate.
-    if (!fun->isLambda() || !currentCallee->isLambda())
-        return currentCallee == fun;
-
     // Use the same condition as |js::CloneFunctionObject|, to know if we should
     // expect both functions to have the same JSScript. If so, and if they are
     // different, then they cannot be equal.
     bool useSameScript = CloneFunctionObjectUseSameScript(fun->compartment(), currentCallee);
     if (useSameScript &&
         (currentCallee->hasScript() != fun->hasScript() ||
          currentCallee->nonLazyScript() != fun->nonLazyScript()))
     {