[INFER] Fix test for when double entries need to be forgotten after branching to a location their type is unknown, bug 684576.
authorBrian Hackett <bhackett1024@gmail.com>
Mon, 05 Sep 2011 07:29:51 -0700
changeset 76583 370d051a4c95cc4e5cb2e57545e0bffff3ef3cec
parent 76582 53e25966f155a16698398921aef9a4f3ba315d40
child 76584 d4696bf0d286e56d9f1399a1cbcf485ed0a5eae4
push id3
push userfelipc@gmail.com
push dateFri, 30 Sep 2011 20:09:13 +0000
bugs684576
milestone9.0a1
[INFER] Fix test for when double entries need to be forgotten after branching to a location their type is unknown, bug 684576.
js/src/jit-test/tests/jaeger/bug684576.js
js/src/methodjit/Compiler.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/bug684576.js
@@ -0,0 +1,10 @@
+// |jit-test| error: TypeError
+function f0(p0,p1) {
+    var v3;
+    do {
+        p1 > v3
+        v3=1.7
+    } while (((p0[p1][5]==1)||(p0[p1][5]==2)||(p0[p1][5] == 3)) + 0 > p0);
+    + (v3(f0));
+}
+f0(4105,8307);
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -7087,17 +7087,17 @@ mjit::Compiler::fixDoubleTypes(jsbytecod
                      * set for the existing value must be empty, so this
                      * code is doomed and we can just mark the value as
                      * a double.
                      */
                     frame.ensureDouble(fe);
                 } else {
                     JS_ASSERT(vt.type == JSVAL_TYPE_DOUBLE);
                 }
-            } else if (fe->isType(JSVAL_TYPE_DOUBLE)) {
+            } else if (vt.type == JSVAL_TYPE_DOUBLE) {
                 fixedDoubleToAnyEntries.append(newv->slot);
                 frame.syncAndForgetFe(fe);
                 frame.forgetLoopReg(fe);
             }
             newv++;
         }
     }
 }