diff options
| -rw-r--r-- | js/src/jit/AliasAnalysisShared.cpp | 1 | ||||
| -rw-r--r-- | js/src/jit/MIR.h | 5 |
2 files changed, 4 insertions, 2 deletions
diff --git a/js/src/jit/AliasAnalysisShared.cpp b/js/src/jit/AliasAnalysisShared.cpp index 99c23d2a3..21a479bf8 100644 --- a/js/src/jit/AliasAnalysisShared.cpp +++ b/js/src/jit/AliasAnalysisShared.cpp @@ -134,6 +134,7 @@ GetObject(const MDefinition* ins) case MDefinition::Op_SetArgumentsObjectArg: case MDefinition::Op_GetFrameArgument: case MDefinition::Op_SetFrameArgument: + case MDefinition::Op_CreateThis: case MDefinition::Op_CompareExchangeTypedArrayElement: case MDefinition::Op_AtomicExchangeTypedArrayElement: case MDefinition::Op_AtomicTypedArrayElementBinop: diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h index 81662a9be..a7daea081 100644 --- a/js/src/jit/MIR.h +++ b/js/src/jit/MIR.h @@ -5007,9 +5007,10 @@ class MCreateThis TRIVIAL_NEW_WRAPPERS NAMED_OPERANDS((0, getCallee), (1, getNewTarget)) - // Although creation of |this| modifies global state, it is safely repeatable. + // Performs a property read from |newTarget| if |newTarget| is a JSFunction + // with an own |.prototype| property. AliasSet getAliasSet() const override { - return AliasSet::None(); + return AliasSet::Load(AliasSet::Any); } bool possiblyCalls() const override { return true; |