author | Nicolas B. Pierron <nicolas.b.pierron@mozilla.com> |
Fri, 13 Mar 2015 16:14:03 +0100 | |
changeset 233561 | f0f3cba361d1cc2ae315b440ba9c7fe05275eff4 |
parent 233560 | af8b6c7b05f8a3ce7898a83d788a080b0c0466de |
child 233562 | 56da5d401fe2b13af17c353350ea3729d8018419 |
push id | 28417 |
push user | ryanvm@gmail.com |
push date | Fri, 13 Mar 2015 19:52:44 +0000 |
treeherder | mozilla-central@977add19414a [default view] [failures only] |
perfherder | [talos] [build metrics] [platform microbench] (compared to previous push) |
reviewers | shu |
bugs | 1133389 |
milestone | 39.0a1 |
first release with | nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
|
last release without | nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
|
js/src/jit-test/tests/ion/recover-lambdas-bug1133389.js | file | annotate | diff | comparison | revisions | |
js/src/vm/Stack.cpp | file | annotate | diff | comparison | revisions |
new file mode 100644 --- /dev/null +++ b/js/src/jit-test/tests/ion/recover-lambdas-bug1133389.js @@ -0,0 +1,17 @@ +var o = {} +Object.defineProperty(o, "p", { + get: function() { + return arguments.callee.caller.caller; + } +}); + +function f() { + function g() { + return o.p; + } + return g(); +} + +for (var k = 0; k < 2; k++) { + assertEq(f(), f); +}
--- a/js/src/vm/Stack.cpp +++ b/js/src/vm/Stack.cpp @@ -1103,22 +1103,16 @@ FrameIter::matchCallee(JSContext *cx, Ha // template from which it would be cloned, we compare properties which are // stable across the cloning of JSFunctions. if (((currentCallee->flags() ^ fun->flags()) & JSFunction::STABLE_ACROSS_CLONES) != 0 || currentCallee->nargs() != fun->nargs()) { return false; } - // Only some lambdas are optimized in a way which cannot be recovered without - // invalidating the frame. Thus, if one of the function is not a lambda we can just - // compare it against the calleeTemplate. - if (!fun->isLambda() || !currentCallee->isLambda()) - return currentCallee == fun; - // Use the same condition as |js::CloneFunctionObject|, to know if we should // expect both functions to have the same JSScript. If so, and if they are // different, then they cannot be equal. bool useSameScript = CloneFunctionObjectUseSameScript(fun->compartment(), currentCallee); if (useSameScript && (currentCallee->hasScript() != fun->hasScript() || currentCallee->nonLazyScript() != fun->nonLazyScript())) {