Bug 1247871 - Don't fold JSOP_IN if the rhs might be primitive. r=h4writer
authorJan de Mooij <jdemooij@mozilla.com>
Mon, 22 Feb 2016 11:21:49 +0100
changeset 321366 c932db79d2528d2c8c665d870831d55db2487099
parent 321365 4e0f184fd883003e385d538f70b7e9ca033e3aca
child 321367 5b00dd063fbf87fc60b93e382eed36185e7a041b
push id5913
push userjlund@mozilla.com
push dateMon, 25 Apr 2016 16:57:49 +0000
treeherdermozilla-beta@dcaf0a6fa115 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersh4writer
bugs1247871
milestone47.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1247871 - Don't fold JSOP_IN if the rhs might be primitive. r=h4writer
js/src/jit-test/tests/ion/fold-in.js
js/src/jit/IonBuilder.cpp
--- a/js/src/jit-test/tests/ion/fold-in.js
+++ b/js/src/jit-test/tests/ion/fold-in.js
@@ -25,8 +25,20 @@ function g(arr) {
 	res += "x" in o;
 	res += "abcd" in o;
     }
     return res;
 }
 assertEq(g(arr), 250);
 arr[0].abcd = 3;
 assertEq(g(arr), 375);
+
+function testPrimitive() {
+    var x = 7;
+    var c = 0;
+    for (var i=0; i<5; i++) {
+	try {
+	    "z" in x;
+	} catch(e) { c++; }
+    }
+    assertEq(c, 5);
+}
+testPrimitive();
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -13425,17 +13425,17 @@ IonBuilder::inTryFold(bool* emitted, MDe
     jsid propId;
     if (!idConst || !ValueToIdPure(idConst->toJSValue(), &propId))
         return true;
 
     if (propId != IdToTypeId(propId))
         return true;
 
     TemporaryTypeSet* types = obj->resultTypeSet();
-    if (!types || types->unknownObject())
+    if (!types || types->unknownObject() || types->getKnownMIRType() != MIRType_Object)
         return true;
 
     for (unsigned i = 0, count = types->getObjectCount(); i < count; i++) {
         TypeSet::ObjectKey* key = types->getObject(i);
         if (!key)
             continue;
 
         while (true) {