Bug 602413 - Trash them, trash them all! (r=dvander)
authorLuke Wagner <lw@mozilla.com>
Thu, 11 Nov 2010 15:51:10 -0800
changeset 57804 ba3f9d1c5e5e4e4693ecad1e7d442964e85e9ee6
parent 57803 2e91aa1d2ff54f01d10ed94afeda5dd5986decca
child 57805 15bedd8d543481dae6d81e59421a49411c0b0cdf
push id1
push usershaver@mozilla.com
push dateTue, 04 Jan 2011 17:58:04 +0000
reviewersdvander
bugs602413
milestone2.0b8pre
Bug 602413 - Trash them, trash them all! (r=dvander)
js/src/jit-test/tests/basic/testBug602413.js
js/src/jstracer.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/testBug602413.js
@@ -0,0 +1,45 @@
+var so = [];
+
+function U(unusedV)
+{
+  for (var i = 0; i < so.length; ++i)
+    return false;
+  so.push(0);
+}
+
+function C(v)
+{
+  if (typeof v == "object" || typeof v == "function") {
+    for (var i = 0; i < 10; ++i) {}
+    U(v);
+  }
+}
+
+function exploreProperties(obj)
+{
+  var props = [];
+  for (var o = obj; o; o = Object.getPrototypeOf(o)) {
+    props = props.concat(Object.getOwnPropertyNames(o));
+  }
+  for (var i = 0; i < props.length; ++i) {
+    var p = props[i];
+    try { 
+      var v = obj[p];
+      C(v);
+    } catch(e) { }
+  }
+}
+
+function boom()
+{
+  var a = [];
+  var b = function(){};
+  var c = [{}];
+  exploreProperties(a);
+  exploreProperties(b);
+  exploreProperties(c);
+  exploreProperties(c);
+}
+
+boom();
+
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -5006,17 +5006,17 @@ TraceRecorder::joinEdgesToEntry(TreeFrag
             } else {
                 /* Check for int32->double slots that suggest trashing. */
                 if (findUndemotesInTypemaps(typeMap, tree, undemotes)) {
                     JS_ASSERT(peer == uexit->fragment->root);
                     if (fragment == peer)
                         trashSelf = true;
                     else
                         whichTreesToTrash.addUnique(uexit->fragment->root);
-                    return;
+                    break;
                 }
                 uexit = uexit->next;
             }
         }
     }
 }
 
 JS_REQUIRES_STACK AbortableRecordingStatus