1091725 - Fix barrier computation for MNewDerivedTypedObject

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Brian Hackett [Laid off!]]

Attachment: patch

After bug 1069688 and bug 1083600 the code which determines whether to add barriers on MNewDerivedTypedObject is incorrect, and barriers more instructions than necessary.  Fixing this will fix the regression in misc-typedobj-write-struct-field-typedobj.js on AWFY from from bug 1083600.

Comment 1

[Niko Matsakis [:nmatsakis]]

Comment on attachment 8514387 [details] [diff] [review]
patch

Review of attachment 8514387 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit/IonBuilder.cpp
@@ +7386,5 @@
>                                                                  ownerOffset);
>      current->add(derivedTypedObj);
>      current->push(derivedTypedObj);
>  
> +    // Determine (if possible) the class/proto that `derivedTypedObj` will 

Nit: trailing whitespace

Comment 2

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7f3832f15cb6

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/7f3832f15cb6