Merge global type maps at the loop nesting anchor site (496743, r=gal).
authordanderson@mozilla.com
Sat, 06 Jun 2009 14:04:23 -0700
changeset 25910 2d0f0efc8f142f6af11a2a1d5690241a05408ee9
parent 25909 3b76e2b5482b6a93d0eefecc764e5e9217fb6dcc
child 25911 a9144e37cd8e4ec8ac22f8dcc0982f796a72b1b0
push id1664
push userrsayre@mozilla.com
push dateMon, 08 Jun 2009 17:47:56 +0000
reviewersgal
bugs496743
milestone1.9.1pre
Merge global type maps at the loop nesting anchor site (496743, r=gal).
js/src/jstracer.cpp
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -4016,17 +4016,21 @@ js_AttemptToExtendTree(JSContext* cx, VM
                guard (anchor) has the type information for everything below the current scope,
                and the actual guard we exited from has the types for everything in the current
                scope (and whatever it inlined). We have to merge those maps here. */
             VMSideExit* e1 = anchor;
             VMSideExit* e2 = exitedFrom;
             fullMap.add(getStackTypeMap(e1), e1->numStackSlotsBelowCurrentFrame);
             fullMap.add(getStackTypeMap(e2), e2->numStackSlots);
             stackSlots = fullMap.length();
-            fullMap.add(getGlobalTypeMap(e1), e1->numGlobalSlots);
+            fullMap.add(getGlobalTypeMap(e2), e2->numGlobalSlots);
+            if (e1->numGlobalSlots >= e2->numGlobalSlots) {
+                fullMap.add(getGlobalTypeMap(e1) + e2->numGlobalSlots,
+                            e1->numGlobalSlots - e2->numGlobalSlots);
+            }
             ngslots = e1->numGlobalSlots;
             typeMap = fullMap.data();
         }
         JS_ASSERT(ngslots >= anchor->numGlobalSlots);
         return js_StartRecorder(cx, anchor, c, (TreeInfo*)f->vmprivate, stackSlots,
                                 ngslots, typeMap, exitedFrom, outer, cx->fp->argc);
     }
     return false;