Closed
Bug 1104027
Opened 9 years ago
Closed 9 years ago
SETELEM can abort IonBuilder arguments analysis
Categories
(Core :: JavaScript Engine: JIT, defect)
Core
JavaScript Engine: JIT
Tracking
()
RESOLVED
FIXED
mozilla36
People
(Reporter: jandem, Assigned: jandem)
References
Details
Attachments
(1 file)
1.05 KB,
patch
|
bhackett1024
:
review+
|
Details | Diff | Splinter Review |
Till noticed that the arguments analysis doesn't work for a function with a loop like this: var argArray = []; for (var _i = 1; _i < arguments.length; _i++) { argArray[_i - 1] = arguments[_i]; } The analysis runs before baseline compilation, so we have no template object for JSOP_NEWARRAY and IonBuilder uses MUnknownValue. IonBuilder::jsop_setelem then aborts because it thinks the value might be an optimized arguments object.
Attachment #8527703 -
Flags: review?(bhackett1024)
Updated•9 years ago
|
Attachment #8527703 -
Flags: review?(bhackett1024) → review+
Assignee | ||
Comment 1•9 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/111b2dd131cf
https://hg.mozilla.org/mozilla-central/rev/111b2dd131cf
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla36
You need to log in
before you can comment on or make changes to this bug.
Description
•