Closed
Bug 898576
Opened 11 years ago
Closed 11 years ago
IonMonkey: Ignore inputs with empty type sets when specializing phis
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla25
People
(Reporter: shu, Assigned: shu)
References
Details
Attachments
(1 file)
2.13 KB,
patch
|
jandem
:
review+
|
Details | Diff | Splinter Review |
We already ignore inputs with empty type sets inside IonBuilder, but we don't do this when applying type information. This causes some unfortunate code to be generated; take this snippet: var foo; if (cond) foo = 0; else foo = SomeNeverExecutedFunction(); print("" + foo); Assuming cond is always true, during IonBuilder, the phi for foo is Int32 because we never run the other branch. We generate an MConcat for the +. After applying type info, the phi is now MIRType_Value, and we inserted an MBox for foo = 0. MConcat's type policy then generates an MUnbox (to String! lol) for foo, and we always bail out during execution.
Assignee | ||
Comment 1•11 years ago
|
||
Assignee: general → shu
Attachment #781868 -
Flags: review?(jdemooij)
Updated•11 years ago
|
Attachment #781868 -
Flags: review?(jdemooij) → review+
Comment 2•11 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/471dcc138dfe
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla25
You need to log in
before you can comment on or make changes to this bug.
Description
•