bug1700616.js (933B)
1 function dummy() { with ({}) {}} 2 3 function foo() { 4 var a = 0; 5 var b = 1; 6 var c = 2; 7 var d = 3; 8 9 // This call will run before we enter jitcode and won't have IC 10 // data, so branch pruning will remove the path from the entry 11 // block to the OSR preheader. 12 dummy(); 13 14 // We will OSR in this loop. Because there's no path from the 15 // function entry to the loop, the only information we have 16 // about a, b, c, and d is that they come from the OSR block. 17 for (var i = 0; i < 1000; i++) { 18 19 // Create a bunch of phis that only depend on OsrValues. 20 // These phis will be specialized to MIRType::Value. 21 a = i % 2 ? b : c; 22 b = i % 3 ? c : d; 23 c = i % 4 ? d : a; 24 d = i % 5 ? a : b; 25 26 // This phi will be optimistically specialized to 27 // MIRType::String and trigger a bailout. 28 dummy(i % 6 ? d : ""); 29 } 30 return a; 31 } 32 foo();