Noticed this while looking at some benchmarks. The following testcase throws a "TypeError: round is not a function" on m-c: var a = [1]; function f(x) { var round = Math.round; for (var i=0; i<20; i++) { a[0] = round(a[0]); if (x > 500) a[0] = "a"; } } for (var i=0; i<550; i++) f(i);

Sets the Folded flag on the MIR instruction after inlining a native call.

Noticed this on a raytracer, so this breaks real-world code. Updating flags.

Comment on attachment 722180 [details] [diff] [review] Patch [Approval Request Comment] Bug caused by (feature/regressing bug #): Bug 818869 User impact if declined: Correctness issues, websites not working Testing completed (on m-c, etc.): On m-c Risk to taking this patch (and alternatives if risky): Very low String or UUID changes made by this patch: None

Comment on attachment 722180 [details] [diff] [review] Patch low risk uplift of a Fx20 regression which helps avoid broken websites.Approving for uplift

https://hg.mozilla.org/releases/mozilla-aurora/rev/9cd73a76c112 This doesn't apply cleanly to beta. Please post a branch-specific patch.

Beta does not have callInfo.

Comment on attachment 723398 [details] [diff] [review] Patch for beta Review of attachment 723398 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/jit-test/tests/ion/bug848733.js @@ +7,5 @@ > + a[0] = "a"; > + } > +} > +for (var i=0; i<550; i++) > + f(i); I don't think the new test is needed on beta.