[INFER] Fix bogus assert when restoring analysis types, bug 642254.
authorBrian Hackett <bhackett1024@gmail.com>
Thu, 17 Mar 2011 11:54:06 -0700
changeset 74799 b3c0144afa64c51dd7b7711c213232f29a9bfc9a
parent 74798 ecae35e0821df602e346f81e6a9bad047ac9cae6
child 74800 8b5eb3c09698e37b25071fd3820491e20ec0465e
push id2
push userbsmedberg@mozilla.com
push dateFri, 19 Aug 2011 14:38:13 +0000
bugs642254
milestone2.0b13pre
[INFER] Fix bogus assert when restoring analysis types, bug 642254.
js/src/jit-test/tests/basic/bug642254.js
js/src/methodjit/Compiler.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug642254.js
@@ -0,0 +1,4 @@
+function f(i) {
+  for (var n = 0; n < 0; n = i) { }
+}
+actual = f(.5);
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -5699,26 +5699,28 @@ mjit::Compiler::restoreAnalysisTypes(uin
     if (!cx->typeInferenceEnabled())
         return;
 
     /* Restore known types of locals/args, for join points or after forgetting everything. */
     for (uint32 i = 0; i < script->nfixed; i++) {
         JSValueType type = knownLocalType(i);
         if (type != JSVAL_TYPE_UNKNOWN && (type != JSVAL_TYPE_DOUBLE || !analysis->localEscapes(i))) {
             FrameEntry *fe = frame.getLocal(i);
-            JS_ASSERT(!fe->isTypeKnown());
-            frame.learnType(fe, type, false);
+            JS_ASSERT_IF(fe->isTypeKnown(), fe->isType(type));
+            if (!fe->isTypeKnown())
+                frame.learnType(fe, type, false);
         }
     }
     for (uint32 i = 0; fun && i < fun->nargs; i++) {
         JSValueType type = knownArgumentType(i);
         if (type != JSVAL_TYPE_UNKNOWN && (type != JSVAL_TYPE_DOUBLE || !analysis->argEscapes(i))) {
             FrameEntry *fe = frame.getArg(i);
-            JS_ASSERT(!fe->isTypeKnown());
-            frame.learnType(fe, type, false);
+            JS_ASSERT_IF(fe->isTypeKnown(), fe->isType(type));
+            if (!fe->isTypeKnown())
+                frame.learnType(fe, type, false);
         }
     }
 }
 
 JSValueType
 mjit::Compiler::knownThisType()
 {
     if (!cx->typeInferenceEnabled())