Bug 1155474 - Consider the input to MThrowUninitializedLexical implicitly used. r=Waldo, a=sledru
authorShu-yu Guo <shu@rfrn.org>
Tue, 28 Apr 2015 01:44:22 -0700
changeset 267270 3bc69f217d411d7f31c877971e7352bb29c2b55d
parent 267269 eb3678cd33b676a3aed20de211d1915475bf5132
child 267271 c15aa6ab2bf4ce76428d0ac3f657feec250d9f65
push id830
push userraliiev@mozilla.com
push dateFri, 19 Jun 2015 19:24:37 +0000
treeherdermozilla-release@932614382a68 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersWaldo, sledru
bugs1155474
milestone39.0a2
Bug 1155474 - Consider the input to MThrowUninitializedLexical implicitly used. r=Waldo, a=sledru
js/src/jit-test/tests/ion/lexical-check-5.js
js/src/jit/IonBuilder.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/lexical-check-5.js
@@ -0,0 +1,7 @@
+// |jit-test| error: ReferenceError
+
+{
+  for (var i = 0; i < 100; i++)
+    a += i;
+  let a = 1;
+}
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -12875,16 +12875,19 @@ MDefinition*
 IonBuilder::addLexicalCheck(MDefinition* input)
 {
     MOZ_ASSERT(JSOp(*pc) == JSOP_CHECKLEXICAL || JSOp(*pc) == JSOP_CHECKALIASEDLEXICAL);
 
     MInstruction* lexicalCheck;
 
     // If we're guaranteed to not be JS_UNINITIALIZED_LEXICAL, no need to check.
     if (input->type() == MIRType_MagicUninitializedLexical) {
+        // Mark the input as implicitly used so the JS_UNINITIALIZED_LEXICAL
+        // magic value will be preserved on bailout.
+        input->setImplicitlyUsedUnchecked();
         lexicalCheck = MThrowUninitializedLexical::New(alloc());
         current->add(lexicalCheck);
         if (!resumeAfter(lexicalCheck))
             return nullptr;
         return constant(UndefinedValue());
     }
 
     if (input->type() == MIRType_Value) {