Bug 1079850 - IonMonkey: Handle case where filtering sees incompatible types, r=jandem
authorHannes Verschore <hv1989@gmail.com>
Fri, 10 Oct 2014 09:54:23 +0200
changeset 232964 790c862b4c2a4a0fbd093f25fad8e886aca79698
parent 232963 19917edca5d7b99219d5ad13add0305f3cea684b
child 232965 f7c8dd2b7e1b7ebd2ad7b1489d68b49e5cf7de15
push id4187
push userbhearsum@mozilla.com
push dateFri, 28 Nov 2014 15:29:12 +0000
treeherdermozilla-beta@f23cc6a30c11 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1079850
milestone35.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1079850 - IonMonkey: Handle case where filtering sees incompatible types, r=jandem
js/src/jit-test/tests/ion/bug1079850.js
js/src/jit/TypePolicy.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1079850.js
@@ -0,0 +1,5 @@
+function foo() {
+    for(__key in null)
+        var key=startTest(VERSION) ? this : this;
+    if (key !== undefined) {}
+} foo();
--- a/js/src/jit/TypePolicy.cpp
+++ b/js/src/jit/TypePolicy.cpp
@@ -861,20 +861,26 @@ FilterTypeSetPolicy::adjustInputs(TempAl
 
     // Output is a value, box the input.
     if (outputType == MIRType_Value) {
         MOZ_ASSERT(inputType != MIRType_Value);
         ins->replaceOperand(0, boxAt(alloc, ins, ins->getOperand(0)));
         return true;
     }
 
-    // The outputType should always be a subset of the inputType.
-    // So if types don't equal, the input type is definitely a MIRType_Value.
-    if (inputType != MIRType_Value)
-        MOZ_CRASH("Types should be in accordance.");
+    // The outputType should be a subset of the inputType else we are in code
+    // that has never executed yet. Bail to see the new type (if that hasn't
+    // happened yet).
+    if (inputType != MIRType_Value) {
+        MBail *bail = MBail::New(alloc);
+        ins->block()->insertBefore(ins, bail);
+        bail->setDependency(ins->dependency());
+        ins->setDependency(bail);
+        ins->replaceOperand(0, boxAt(alloc, ins, ins->getOperand(0)));
+    }
 
     // We can't unbox a value to null/undefined/lazyargs. So keep output
     // also a value.
     // Note: Using setResultType shouldn't be done in TypePolicies,
     //       Here it is fine, since the type barrier has no uses.
     if (IsNullOrUndefined(outputType) || outputType == MIRType_MagicOptimizedArguments) {
         MOZ_ASSERT(!ins->hasDefUses());
         ins->setResultType(MIRType_Value);