Bug 913749 - Mark fallible unbox instructions as guards. r=h4writer
authorJan de Mooij <jdemooij@mozilla.com>
Fri, 13 Sep 2013 10:09:11 +0200
changeset 159876 2b4aa0f8515ed62122754335a4c034a966cde79c
parent 159875 893512a52cfc1e97f44e05905849458a2ffca6b7
child 159886 ad5600f82b59995613b512147ff5857e9dfcfb34
child 159909 fc0c3197f74a8cfdea252ab4ebd02a81a75d959a
push id2961
push userlsblakk@mozilla.com
push dateMon, 28 Oct 2013 21:59:28 +0000
treeherdermozilla-beta@73ef4f13486f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersh4writer
bugs913749
milestone26.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 913749 - Mark fallible unbox instructions as guards. r=h4writer
js/src/jit-test/tests/ion/bug913749.js
js/src/jit/MIR.h
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug913749.js
@@ -0,0 +1,20 @@
+y = Float32Array(11);
+x = [];
+
+Object.defineProperty(x, 18, {
+    get: (function() {
+        y.length;
+    }),
+});
+this.toSource();
+
+y = undefined;
+
+for (var i = 0; i < 3; i++) {
+    try {
+	x.toString();
+	assertEq(0, 1);
+    } catch (e) {
+	assertEq(e.message, "y is undefined");
+    }
+}
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -2192,17 +2192,17 @@ class MUnbox : public MUnaryInstruction,
                   type == MIRType_Double  ||
                   type == MIRType_String  ||
                   type == MIRType_Object);
 
         setResultType(type);
         setResultTypeSet(ins->resultTypeSet());
         setMovable();
 
-        if (mode_ == TypeBarrier)
+        if (mode_ == TypeBarrier || mode_ == Fallible)
             setGuard();
 
         bailoutKind_ = kind;
     }
   public:
     INSTRUCTION_HEADER(Unbox)
     static MUnbox *New(MDefinition *ins, MIRType type, Mode mode)
     {