Bug 1216130 part 2 - Add test. r=bhackett
authorJan de Mooij <jdemooij@mozilla.com>
Sat, 27 Feb 2016 17:32:44 +0100
changeset 324173 bd00e87978b27e113286a2005361012abc4a39d1
parent 324172 0a48f8ebe02fc7397a2dca7f80ae7d9d58089c49
child 324174 2b7831bde59d8313a2e6320aacf3e13ba09f98cf
push id1128
push userjlund@mozilla.com
push dateWed, 01 Jun 2016 01:31:59 +0000
treeherdermozilla-release@fe0d30de989d [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett
bugs1216130
milestone47.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1216130 part 2 - Add test. r=bhackett
js/src/jit-test/tests/ion/bug1216130.js
js/src/jit/IonBuilder.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1216130.js
@@ -0,0 +1,50 @@
+function Obj1(x) { this.x = x; }
+function f1() {
+    var arr = [], o = {};
+    for (var i=0; i<2500; i++) {
+        arr.push(new Obj1(o));
+        if (i < 15) {
+            arr[i].x = undefined;
+            arr[i].x = Math;
+        }
+    }
+    for (var i=0; i<2500; i++) {
+        var y = (i > 2000) ? undefined : o;
+        arr[i].x = y;
+    }
+}
+f1();
+
+function f2() {
+    var arr = [], p = {};
+    for (var i=0; i<2500; i++) {
+        var x = (i < 2000) ? p : undefined;
+        var o = {x: x};
+        if (i < 5) {
+            o.x = undefined;
+            o.x = p;
+        }
+        arr.push(o);
+    }
+    for (var i=0; i<2500; i++) {
+        assertEq(arr[i].x, i < 2000 ? p : undefined);
+    }
+}
+f2();
+
+function f3() {
+    var arr = [], p = {};
+    for (var i=0; i<2500; i++) {
+        var x = (i < 2000) ? p : true;
+        var o = {x: x};
+        if (i < 5) {
+            o.x = true;
+            o.x = p;
+        }
+        arr.push(o);
+    }
+    for (var i=0; i<2500; i++) {
+        assertEq(arr[i].x, i < 2000 ? p : true);
+    }
+}
+f3();
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -12545,16 +12545,21 @@ IonBuilder::storeUnboxedValue(MDefinitio
         break;
 
       case JSVAL_TYPE_STRING:
         store = MStoreUnboxedString::New(alloc(), elements, scaledOffset, value,
                                          elementsOffset, preBarrier);
         break;
 
       case JSVAL_TYPE_OBJECT:
+        MOZ_ASSERT(value->type() == MIRType_Object ||
+                   value->type() == MIRType_Null ||
+                   value->type() == MIRType_Value);
+        MOZ_ASSERT(!value->mightBeType(MIRType_Undefined),
+                   "MToObjectOrNull slow path is invalid for unboxed objects");
         store = MStoreUnboxedObjectOrNull::New(alloc(), elements, scaledOffset, value, obj,
                                                elementsOffset, preBarrier);
         break;
 
       default:
         MOZ_CRASH();
     }