Bug 1076026 - Don't consider uninitialized lexicals when initializing a singleton object property type. (r=bhackett)
authorShu-yu Guo <shu@rfrn.org>
Wed, 15 Oct 2014 18:06:49 -0700
changeset 210664 748ffeff132c1c5c7bcea9e44a74d4ba0bf08374
parent 210663 e59d5635eef20f7e9a215339cfef0010a282b470
child 210665 0b865ab14ff00cb11bf45e02b51b663c450629e7
push id1
push userroot
push dateMon, 20 Oct 2014 17:29:22 +0000
reviewersbhackett
bugs1076026
milestone36.0a1
Bug 1076026 - Don't consider uninitialized lexicals when initializing a singleton object property type. (r=bhackett)
js/src/jit-test/tests/ion/bug1076026.js
js/src/jsinfer.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1076026.js
@@ -0,0 +1,9 @@
+(function f() {
+    let x = (new function() {})
+    __defineGetter__("x", function() {
+        ({
+            e: x
+        })
+    })
+})();
+print(x)
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -2926,18 +2926,24 @@ UpdatePropertyType(ExclusiveContext *cx,
             types->setDefinite(shape->slot());
 
         const Value &value = obj->getSlot(shape->slot());
 
         /*
          * Don't add initial undefined types for properties of global objects
          * that are not collated into the JSID_VOID property (see propertySet
          * comment).
+         *
+         * Also don't add initial uninitialized lexical magic values as
+         * appearing in CallObjects.
          */
-        if (indexed || !value.isUndefined() || !CanHaveEmptyPropertyTypesForOwnProperty(obj)) {
+        MOZ_ASSERT_IF(value.isMagic(JS_UNINITIALIZED_LEXICAL), obj->is<CallObject>());
+        if ((indexed || !value.isUndefined() || !CanHaveEmptyPropertyTypesForOwnProperty(obj)) &&
+            !value.isMagic(JS_UNINITIALIZED_LEXICAL))
+        {
             Type type = GetValueType(value);
             types->TypeSet::addType(type, &cx->typeLifoAlloc());
         }
 
         if (indexed || shape->hadOverwrite()) {
             types->setNonConstantProperty(cx);
         } else {
             InferSpew(ISpewOps, "typeSet: %sT%p%s property %s %s - setConstant",