Bug 847412 - Monitor result type after a direct eval from Ion code, r=jandem.
authorBrian Hackett <bhackett1024@gmail.com>
Tue, 19 Mar 2013 08:47:06 -0600
changeset 131845 91575402209a56084b85e1b2b585f192dd7cc812
parent 131844 2ed966e4fa58c1c52dde286630ff1986a1bfb3ed
child 131846 85eca178a678385f98a385935dfcffa8bb775fdc
push idunknown
push userunknown
push dateunknown
reviewersjandem
bugs847412
milestone22.0a1
Bug 847412 - Monitor result type after a direct eval from Ion code, r=jandem.
js/src/ion/IonBuilder.cpp
js/src/jit-test/tests/ion/bug847412.js
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -4464,17 +4464,20 @@ IonBuilder::jsop_eval(uint32_t argc)
         }
 
         MInstruction *filterArguments = MFilterArguments::New(string);
         current->add(filterArguments);
 
         MInstruction *ins = MCallDirectEval::New(scopeChain, string, thisValue);
         current->add(ins);
         current->push(ins);
-        return resumeAfter(ins);
+
+        types::StackTypeSet *barrier;
+        types::StackTypeSet *types = oracle->returnTypeSet(script(), pc, &barrier);
+        return resumeAfter(ins) && pushTypeBarrier(ins, types, barrier);
     }
 
     return jsop_call(argc, /* constructing = */ false);
 }
 
 bool
 IonBuilder::jsop_compare(JSOp op)
 {
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug847412.js
@@ -0,0 +1,19 @@
+
+var gTestcases = new Array();
+var gTc = gTestcases.length;
+function TestCase( a) {
+  this.actual = a;
+  gTestcases[gTc++] = this;
+}
+function test() {
+  for ( gTc=0; gTc < gTestcases.length; gTc++ ) {
+	gTestcases[gTc].actual.toString()
+  }
+}
+function testOverwritingSparseHole() {
+  for (var i = 0; i < 50; i++)
+    new TestCase(eval("VAR1 = 0; VAR2 = -1; VAR1 %= VAR2; VAR1"));
+}
+testOverwritingSparseHole();
+test();
+this.toSource();