Closed Bug 1104027 Opened 8 years ago Closed 8 years ago

SETELEM can abort IonBuilder arguments analysis

Categories

(Core :: JavaScript Engine: JIT, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla36

People

(Reporter: jandem, Assigned: jandem)

References

Details

Attachments

(1 file)

Attached patch PatchSplinter Review
Till noticed that the arguments analysis doesn't work for a function with a loop like this:

    var argArray = [];
    for (var _i = 1; _i < arguments.length; _i++) {
        argArray[_i - 1] = arguments[_i];
    }

The analysis runs before baseline compilation, so we have no template object for JSOP_NEWARRAY and IonBuilder uses MUnknownValue. 

IonBuilder::jsop_setelem then aborts because it thinks the value might be an optimized arguments object.
Attachment #8527703 - Flags: review?(bhackett1024)
Attachment #8527703 - Flags: review?(bhackett1024) → review+
https://hg.mozilla.org/mozilla-central/rev/111b2dd131cf
Status: ASSIGNED → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla36
You need to log in before you can comment on or make changes to this bug.