Bug 920463 - Use correct index when iterating over type objects r=jandem
authorNicholas D. Matsakis <nmatsakis@mozilla.com>
Thu, 10 Oct 2013 16:58:11 -0400
changeset 165812 07cd65e9f5c70bb42e8ad3dbecec235739944c34
parent 165811 e3c9d95e5bc0bce5026330f9c1aed4d27b7ba777
child 165813 1b2970c8d6dd62bfca17c47d250e09cd05eafba0
push id3066
push userakeybl@mozilla.com
push dateMon, 09 Dec 2013 19:58:46 +0000
treeherdermozilla-beta@a31a0dce83aa [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs920463
milestone27.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 920463 - Use correct index when iterating over type objects r=jandem
js/src/jit-test/tests/TypedObject/bug920463.js
js/src/jit/IonBuilder.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/bug920463.js
@@ -0,0 +1,15 @@
+if (!this.hasOwnProperty("TypedObject"))
+  throw new TypeError();
+
+var StructType = TypedObject.StructType;
+var float64 = TypedObject.float64;
+
+var PointType3 = new StructType({ x: float64, y: float64});
+function xPlusY(p) {
+  return p.x + p.y;
+}
+var N = 30000;
+for (var i = 0; i < N; ++i && xPlusY(function () { p; }) ) {
+  obj = new PointType3();
+  xPlusY(obj)
+}
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -9524,17 +9524,17 @@ IonBuilder::lookupTypeRepresentationSet(
         return true;
 
     // And only known objects.
     if (types->unknownObject())
         return true;
 
     TypeRepresentationSetBuilder set;
     for (uint32_t i = 0; i < types->getObjectCount(); i++) {
-        types::TypeObject *type = types->getTypeObject(0);
+        types::TypeObject *type = types->getTypeObject(i);
         if (!type || type->unknownProperties())
             return true;
 
         if (!type->hasTypedObject())
             return true;
 
         TypeRepresentation *typeRepr = type->typedObject()->typeRepr;
         if (!set.insert(typeRepr))