Bug 1155474 - Consider the input to MThrowUninitializedLexical implicitly used. r=Waldo, a=sledru
authorShu-yu Guo <shu@rfrn.org>
Tue, 28 Apr 2015 01:44:22 -0700
changeset 260322 ff65ba4cd38a
parent 260321 0a1accb16d39
child 260327 fa476ca096ea
child 260331 b9f3bdfbf395
child 260385 3e7d597609ba
push id748
push userryanvm@gmail.com
push date2015-04-29 13:41 +0000
treeherdermozilla-release@ff65ba4cd38a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersWaldo, sledru
bugs1155474
milestone38.0
Bug 1155474 - Consider the input to MThrowUninitializedLexical implicitly used. r=Waldo, a=sledru
js/src/jit-test/tests/ion/lexical-check-5.js
js/src/jit/IonBuilder.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/lexical-check-5.js
@@ -0,0 +1,7 @@
+// |jit-test| error: ReferenceError
+
+{
+  for (var i = 0; i < 100; i++)
+    a += i;
+  let a = 1;
+}
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -12468,18 +12468,22 @@ IonBuilder::getCallee()
 
 MDefinition*
 IonBuilder::addLexicalCheck(MDefinition* input)
 {
     MOZ_ASSERT(JSOp(*pc) == JSOP_CHECKLEXICAL || JSOp(*pc) == JSOP_CHECKALIASEDLEXICAL);
 
     // If we're guaranteed to not be JS_UNINITIALIZED_LEXICAL, no need to check.
     MInstruction* lexicalCheck;
-    if (input->type() == MIRType_MagicUninitializedLexical)
+    if (input->type() == MIRType_MagicUninitializedLexical) {
+        // Mark the input as implicitly used so the JS_UNINITIALIZED_LEXICAL
+        // magic value will be preserved on bailout.
+        input->setImplicitlyUsedUnchecked();
         lexicalCheck = MThrowUninitializedLexical::New(alloc());
+    }
     else if (input->type() == MIRType_Value)
         lexicalCheck = MLexicalCheck::New(alloc(), input);
     else
         return input;
 
     current->add(lexicalCheck);
     if (!resumeAfter(lexicalCheck))
         return nullptr;