tor-browser

commit e445026fb0dbfc1b2f084c3ef29172b13a6bcbf0
parent fa4a1ac0315dbfe708504a1331f6bb18ad423bb1
Author: Debadree Chatterjee <debadree333@gmail.com>
Date:   Fri, 24 Oct 2025 07:11:56 +0000

Bug 1995733: Fold MBoxNonStrictThis when inputs are null or undefined. r=jandem

Differential Revision: https://phabricator.services.mozilla.com/D269577

Diffstat:
M
js/src/jit/MIR.cpp
 | 
5
+++++

1 file changed, 5 insertions(+), 0 deletions(-)
diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
@@ -4250,6 +4250,7 @@ static void AssertKnownClass(TempAllocator& alloc, MInstruction* ins,
 
 MDefinition* MBoxNonStrictThis::foldsTo(TempAllocator& alloc) {
   MDefinition* in = input();
+
   if (!in->isBox()) {
     return this;
   }
@@ -4259,6 +4260,10 @@ MDefinition* MBoxNonStrictThis::foldsTo(TempAllocator& alloc) {
     return unboxed;
   }
 
+  if (unboxed->typeIsOneOf({MIRType::Undefined, MIRType::Null})) {
+    return MConstant::NewObject(alloc, this->globalThis());
+  }
+
   return this;
 }