tor-browser

commit d822c1b481c92a5b7cf998528204bfaafa4853ca
parent c104700c3faed0bc4fde9e414340b776b5c2988d
Author: André Bargull <andre.bargull@gmail.com>
Date:   Mon, 20 Oct 2025 12:27:43 +0000

Bug 1991402 - Part 14: Implement LoadFixedSlotTypedResult for IonCacheIRCompiler. r=jandem

`LoadFixedSlotTypedResult` is needed for inlined `Date.prototype.getTime`.

Differential Revision: https://phabricator.services.mozilla.com/D266770

Diffstat:
M
js/src/jit-test/tests/cacheir/inlinable-native-accessor-6.js
 | 
10
++++++++++
M
js/src/jit/IonCacheIRCompiler.cpp
 | 
3
++-

2 files changed, 12 insertions(+), 1 deletion(-)
diff --git a/js/src/jit-test/tests/cacheir/inlinable-native-accessor-6.js b/js/src/jit-test/tests/cacheir/inlinable-native-accessor-6.js
@@ -9,3 +9,13 @@ function testMathRandom() {
   }
 }
 testMathRandom();
+
+function testDateGetTime() {
+  Object.defineProperty(Date.prototype, "time", {get: Date.prototype.getTime});
+
+  var d = new Date(0);
+  for (var i = 0; i < 100; ++i) {
+    assertEq(d.time, 0);
+  }
+}
+testDateGetTime();
diff --git a/js/src/jit/IonCacheIRCompiler.cpp b/js/src/jit/IonCacheIRCompiler.cpp
@@ -940,7 +940,8 @@ bool IonCacheIRCompiler::emitLoadFixedSlotResult(ObjOperandId objId,
 bool IonCacheIRCompiler::emitLoadFixedSlotTypedResult(ObjOperandId objId,
                                                       uint32_t offsetOffset,
                                                       ValueType) {
-  MOZ_CRASH("Call ICs not used in ion");
+  // The type is only used by Warp.
+  return emitLoadFixedSlotResult(objId, offsetOffset);
 }
 
 bool IonCacheIRCompiler::emitLoadDynamicSlotResult(ObjOperandId objId,