From 533b346f4e598f40e7eae81566c6953a2f4cd525 Mon Sep 17 00:00:00 2001 From: Moonchild Date: Tue, 5 May 2020 23:43:22 +0000 Subject: [js] Record load in MCreateThis alias set. --- js/src/jit/AliasAnalysisShared.cpp | 1 + js/src/jit/MIR.h | 5 +++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/js/src/jit/AliasAnalysisShared.cpp b/js/src/jit/AliasAnalysisShared.cpp index 99c23d2a3..21a479bf8 100644 --- a/js/src/jit/AliasAnalysisShared.cpp +++ b/js/src/jit/AliasAnalysisShared.cpp @@ -134,6 +134,7 @@ GetObject(const MDefinition* ins) case MDefinition::Op_SetArgumentsObjectArg: case MDefinition::Op_GetFrameArgument: case MDefinition::Op_SetFrameArgument: + case MDefinition::Op_CreateThis: case MDefinition::Op_CompareExchangeTypedArrayElement: case MDefinition::Op_AtomicExchangeTypedArrayElement: case MDefinition::Op_AtomicTypedArrayElementBinop: diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h index 81662a9be..a7daea081 100644 --- a/js/src/jit/MIR.h +++ b/js/src/jit/MIR.h @@ -5007,9 +5007,10 @@ class MCreateThis TRIVIAL_NEW_WRAPPERS NAMED_OPERANDS((0, getCallee), (1, getNewTarget)) - // Although creation of |this| modifies global state, it is safely repeatable. + // Performs a property read from |newTarget| if |newTarget| is a JSFunction + // with an own |.prototype| property. AliasSet getAliasSet() const override { - return AliasSet::None(); + return AliasSet::Load(AliasSet::Any); } bool possiblyCalls() const override { return true; -- cgit v1.2.3