This is an automated email from the git hooks/post-receive script.
richard pushed a commit to branch tor-browser-91.8.0esr-11.0-1 in repository tor-browser.
commit 158ba86d343f6af0060f9dc570d7065fbb06c216 Author: Lukas Bernhard 15350042+bernhl@users.noreply.github.com AuthorDate: Mon Mar 14 17:18:00 2022 +0000
Bug 1756957 - Fix AliasSet of MLoadTypedArrayElementHole - r=nbp a=RyanVM
Differential Revision: https://phabricator.services.mozilla.com/D139977 --- js/src/jit/MIR.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h index 122338cbf80a6..74a4663e188a2 100644 --- a/js/src/jit/MIR.h +++ b/js/src/jit/MIR.h @@ -6896,7 +6896,8 @@ class MLoadTypedArrayElementHole : public MBinaryInstruction, return congruentIfOperandsEqual(other); } AliasSet getAliasSet() const override { - return AliasSet::Load(AliasSet::UnboxedElement); + return AliasSet::Load(AliasSet::UnboxedElement | AliasSet::ObjectFields | + AliasSet::ArrayBufferViewLengthOrOffset); } bool canProduceFloat32() const override { return arrayType_ == Scalar::Float32;