Bug 1155474 - Consider the input to MThrowUninitializedLexical implicitly used. r=Waldo, a=sledru
💩💩 backed out by 0a1accb16d39 💩 💩
authorShu-yu Guo <shu@rfrn.org>
Tue, 28 Apr 2015 01:44:22 -0700
changeset 260319 daaa2c27b89f
parent 260318 348c2ae68d50
child 260320 fcfec0caa7be
push id747
push userryanvm@gmail.com
push date2015-04-29 13:09 +0000
treeherdermozilla-release@fcfec0caa7be [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersWaldo, sledru
bugs1155474
milestone38.0
Bug 1155474 - Consider the input to MThrowUninitializedLexical implicitly used. r=Waldo, a=sledru
js/src/jit-test/tests/ion/lexical-check-5.js
js/src/jit/IonBuilder.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/lexical-check-5.js
@@ -0,0 +1,7 @@
+// |jit-test| error: ReferenceError
+
+{
+  for (var i = 0; i < 100; i++)
+    a += i;
+  let a = 1;
+}
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -12469,16 +12469,19 @@ IonBuilder::getCallee()
 MDefinition*
 IonBuilder::addLexicalCheck(MDefinition* input)
 {
     MOZ_ASSERT(JSOp(*pc) == JSOP_CHECKLEXICAL || JSOp(*pc) == JSOP_CHECKALIASEDLEXICAL);
 
     // If we're guaranteed to not be JS_UNINITIALIZED_LEXICAL, no need to check.
     MInstruction* lexicalCheck;
     if (input->type() == MIRType_MagicUninitializedLexical)
+        // Mark the input as implicitly used so the JS_UNINITIALIZED_LEXICAL
+        // magic value will be preserved on bailout.
+        input->setImplicitlyUsedUnchecked();
         lexicalCheck = MThrowUninitializedLexical::New(alloc());
     else if (input->type() == MIRType_Value)
         lexicalCheck = MLexicalCheck::New(alloc(), input);
     else
         return input;
 
     current->add(lexicalCheck);
     if (!resumeAfter(lexicalCheck))