Commit d1065b06 authored by Iain Ireland's avatar Iain Ireland
Browse files

Bug 1681056: Guard LICM bailout handling r=jandem 

Differential Revision: https://phabricator.services.mozilla.com/D98978
parent cd589109

js/src/jit-test/tests/warp/bug1681056.js

0 → 100644
+9 −0
Original line number Diff line number Diff line 
gczeal(14,10);

let y = [];

try {

    evaluate(`(function() {

      for (let x10 = 0;

           new class Object extends Object { v = function () {} };

           arguments << this) {}

      })()`);

} catch(exc) {}

js/src/jit/BaselineBailouts.cpp

+7 −5
Original line number Diff line number Diff line
@@ -2063,12 +2063,14 @@ bool jit::FinishBailoutToBaseline(BaselineBailoutInfo* bailoutInfoArg) { 
      // invalidate the script. Otherwise, the next time we reach this

      // point, we will invalidate the script and disable LICM.

      MOZ_ASSERT(!outerScript->hadLICMInvalidation());

      if (outerScript->hasIonScript()) {

        if (outerScript->ionScript()->hadLICMBailout()) {

          outerScript->setHadLICMInvalidation();

          InvalidateAfterBailout(cx, outerScript, "LICM failure");

        } else {

          outerScript->ionScript()->setHadLICMBailout();

        }

      }

      break;



    case BailoutKind::HoistBoundsCheck: