Bug 714397: Inline functions with argc mismatches. (r=sstangl)
authorChris Leary <cdleary@mozilla.com>
Wed, 04 Jan 2012 14:30:01 -0800
changeset 112374 8d6cfd44818fdaa381bebda7cb7c328e34b32dae
parent 112373 bd21710261eb0f9548d4983a0e49caa3e3181ab9
child 112375 478a70bcb33e5d8d4404ea4bf226ca7fdc24b8a4
push id239
push userakeybl@mozilla.com
push dateThu, 03 Jan 2013 21:54:43 +0000
treeherdermozilla-release@3a7b66445659 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssstangl
bugs714397
milestone12.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 714397: Inline functions with argc mismatches. (r=sstangl)
js/src/ion/IonBuilder.cpp
js/src/jit-test/tests/ion/bug714397.js
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -286,44 +286,52 @@ IonBuilder::buildInline(MResumePoint *ca
     MBasicBlock *predecessor = callerResumePoint->block();
     predecessor->end(MGoto::New(current));
     if (!current->addPredecessorWithoutPhis(predecessor))
         return false;
     JS_ASSERT(predecessor->numSuccessors() == 1);
     JS_ASSERT(current->numPredecessors() == 1);
     current->setCallerResumePoint(callerResumePoint);
 
-    if (args.length() != info().nargs())
-        return abort("mismatched argc inlining not yet supported");
+    // Fill in any missing arguments with undefined.
+    const size_t nargs = info().nargs();
+    if (args.length() < nargs) {
+        for (size_t i = 0, missing = nargs - args.length(); i < missing; ++i) {
+            MConstant *undef = MConstant::New(UndefinedValue());
+            current->add(undef);
+            if (!args.append(undef))
+                return false;
+        }
+    }
 
     current->initSlot(info().thisSlot(), thisDefn);
 
-    IonSpew(IonSpew_Inlining, "Initializing %u arg slots", args.length());
+    IonSpew(IonSpew_Inlining, "Initializing %u arg slots", nargs);
 
     // Initialize argument references.
-    for (MDefinition **it = args.begin(), **end = args.end(); it != end; ++it) {
-        MDefinition *arg = *it;
-        size_t i = it - args.begin();
+    JS_ASSERT(args.length() >= nargs);
+    for (size_t i = 0; i < nargs; ++i) {
+        MDefinition *arg = args[i];
         current->initSlot(info().argSlot(i), arg);
     }
 
     IonSpew(IonSpew_Inlining, "Initializing %u local slots", info().nlocals());
 
     // Initialize local variables.
     for (uint32 i = 0; i < info().nlocals(); i++) {
         MConstant *undef = MConstant::New(UndefinedValue());
         current->add(undef);
         current->initSlot(info().localSlot(i), undef);
     }
 
     IonSpew(IonSpew_Inlining, "Inline entry block MResumePoint %p, %u operands",
             (void *) current->entryResumePoint(), current->entryResumePoint()->numOperands());
 
     // Note: +1 for |this|.
-    JS_ASSERT(current->entryResumePoint()->numOperands() == args.length() + info().nlocals() + 1);
+    JS_ASSERT(current->entryResumePoint()->numOperands() == nargs + info().nlocals() + 1);
 
     return traverseBytecode();
 }
 
 // Apply Type Inference information to parameters early on, unboxing them if
 // they have a definitive type. The actual guards will be emitted by the code
 // generator, explicitly, as part of the function prologue.
 void
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug714397.js
@@ -0,0 +1,17 @@
+// Don't assert. Reduced from a modified SS 1.0 crypto-md5.
+
+function g()
+{
+  return 0;
+}
+
+function f()
+{
+  for(var i = 0; i < 100; i++) {
+    g(0);
+    g(0);
+  }
+}
+
+
+f();