Verified Commit abd0241c authored by Iain Ireland's avatar Iain Ireland Committed by ma1
Browse files

Bug 2073267: Add GuardSpecificObject for global lexical SetGName a=dsmith 

Original Revision: https://phabricator.services.mozilla.com/D328386

Differential Revision: https://phabricator.services.mozilla.com/D328730
parent fd2e3987

js/src/jit-test/tests/environments/bug2073267.js

0 → 100644
+18 −0
Changes for js/src/jit-test/tests/environments/bug2073267.js: 18 added lines, 0 removed lines.
Original line number Diff line number Diff line 
function assign(mode) {

  if (mode) {

    newBinding = mode === 1 ? confuse() : "value for global lexical";

  }

}

function confuse() {

  evaluate("let newBinding;");

  for (let i = 0; i < 3; i++) {

    assign(2);

  }

  return "valueForGlobalThis";

}

for (let i = 0; i < 50; i++) {

  assign(0);

}

assign(1);

assertEq(globalThis["newBinding"], "valueForGlobalThis");

assertEq(newBinding, "value for global lexical");

js/src/jit/CacheIR.cpp

+3 −1
Changes for js/src/jit/CacheIR.cpp: 3 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -4615,7 +4615,9 @@ AttachDecision SetPropIRGenerator::tryAttachNativeSetSlot(HandleObject obj, 
  maybeEmitIdGuard(id);









  NativeObject* nobj = &obj->as<NativeObject>();









  if (!IsGlobalLexicalSetGName(JSOp(*pc_), nobj, *prop)) {









  if (IsGlobalLexicalSetGName(JSOp(*pc_), nobj, *prop)) {









    writer.guardSpecificObject(objId, nobj);









  } else {









    TestMatchingNativeReceiver(writer, nobj, objId);









  }









  EmitStoreSlotAndReturn(writer, objId, nobj, *prop, rhsId);