Bug 925470 - Dont use ArgsObj-based args when OSR-ing into scripts with argsObjAliasesFormals=false. r=h4writer, a=bajaj
authorKannan Vijayan <kvijayan@mozilla.com>
Wed, 06 Nov 2013 13:26:44 -0500
changeset 167425 37a77047e1509f8c425d846b6aaab0396bad6ed7
parent 167424 ab968ed42e6550cb1e4b828cf9fb0e5c438633ef
child 167426 47e7b9a3b796bbb45a5f8775264ae39dc9436d57
push id428
push userbbajaj@mozilla.com
push dateTue, 28 Jan 2014 00:16:25 +0000
treeherdermozilla-release@cd72a7ff3a75 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersh4writer, bajaj
bugs925470
milestone27.0a2
Bug 925470 - Dont use ArgsObj-based args when OSR-ing into scripts with argsObjAliasesFormals=false. r=h4writer, a=bajaj
js/src/jit-test/tests/arguments/strict-osr-shadowed-args.js
js/src/jit/IonBuilder.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/arguments/strict-osr-shadowed-args.js
@@ -0,0 +1,13 @@
+
+"use strict";
+
+function loop(a) {
+    a = arguments.length;
+    var result = 0;
+    for (var i = 0; i < 5000; i++) {
+        result += a;
+    }
+    return result;
+}
+
+assertEq(loop(11), 5000);
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -5728,17 +5728,21 @@ IonBuilder::newOsrPreheader(MBasicBlock 
         MParameter *thisv = MParameter::New(MParameter::THIS_SLOT, nullptr);
         osrBlock->add(thisv);
         osrBlock->initSlot(info().thisSlot(), thisv);
 
         // Initialize arguments.
         for (uint32_t i = 0; i < info().nargs(); i++) {
             uint32_t slot = needsArgsObj ? info().argSlotUnchecked(i) : info().argSlot(i);
 
-            if (needsArgsObj) {
+            // Only grab arguments from the arguments object if the arguments object
+            // aliases formals.  If the argsobj does not alias formals, then the
+            // formals may have been assigned to during interpretation, and that change
+            // will not be reflected in the argsobj.
+            if (needsArgsObj && info().argsObjAliasesFormals()) {
                 JS_ASSERT(argsObj && argsObj->isOsrArgumentsObject());
                 // If this is an aliased formal, then the arguments object
                 // contains a hole at this index.  Any references to this
                 // variable in the jitcode will come from JSOP_*ALIASEDVAR
                 // opcodes, so the slot itself can be set to undefined.  If
                 // it's not aliased, it must be retrieved from the arguments
                 // object.
                 MInstruction *osrv;