952942 - Compile array comprehensions

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Jan de Mooij [:jandem]]

I was just looking at a fuzz bug and noticed we don't Baseline/Ion-compile this expression due to the JSOP_ARRAYPUSH op:

    print([x for (x in a) if (x < 10)]);

This is one of the few remaining ops we don't JIT at all, but it should be pretty easy to slow-path this, at least for Baseline.

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Baseline-compile JSOP_ARRAYPUSH

Very simple patch to compile JSOP_ARRAYPUSH.

Comment 2

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9e523f572459

Comment 3

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/9e523f572459