862932 - Parallel JS: inlineUnsafeSetTypedArrayElement is busted

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Felix S. Klock II [:pnkfelix, :fklock]]

The index calculations for `arri`, `idxi`, `elemi` are all busted in the code for IonBuilder::inlineUnsafeSetTypedArrayElement.  No one noticed since its dead code that can only be exposed via self-hosted calls to UnsafeSetElement on typed arrays, which we haven't attempted to do since many merges ago.

Comment 1

[Felix S. Klock II [:pnkfelix, :fklock]]

Attachment: patch A v1: Fix inlineUnsafeSetTypedArrayElement to match other inlined array ops

Comment 2

[Felix S. Klock II [:pnkfelix, :fklock]]

try build: https://tbpl.mozilla.org/?tree=Try&rev=5b3e75aaf14b

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5a12236dba85

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/5a12236dba85