1109054 - MTest::operandMightEmulateUndefined not updated in all cases

Status: RESOLVED INVALID

(Core :: JavaScript Engine: JIT, defect, P3)

Description

[Jan de Mooij [:jandem]]

Yesterday I was looking into bug 1004388 and noticed we have an MTest with operandMightEmulateUndefined = true for the testcase below.

The problem is in MTest::foldsTo: the operand is MNot and we fold it by adding a new MTest, but we don't set operandMightEmulateUndefined = false for this new MTest.

This particular case is easy to fix because MNot also has an operandMightEmulateUndefined flag that we can copy, but there are other places that create new MTest instructions. We should find a way to set this flag consistently, maybe by adding a new argument to the constructor.

function f() {
    var o = {foo: 1};
    var p = null;
    var res = 0;
    for (var i=0; i<10000; i++) {
	var x = (i < 9000) ? o : p;
	if (!x)
	    return res;
	res = x.foo;
    }
    return res;
}
f();

Comment 1

[Boris Zbarsky [:bzbarsky]]

Jeff?  You added this stuff, right?

Comment 2

[André Bargull [:anba]]

No longer valid with Warp, operandMightEmulateUndefined has been removed.