SETELEM can abort IonBuilder arguments analysis

RESOLVED FIXED in mozilla36

Status

()

RESOLVED FIXED
4 years ago
4 years ago

People

(Reporter: jandem, Assigned: jandem)

Tracking

unspecified
mozilla36
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

4 years ago
Created attachment 8527703 [details] [diff] [review]
Patch

Till noticed that the arguments analysis doesn't work for a function with a loop like this:

    var argArray = [];
    for (var _i = 1; _i < arguments.length; _i++) {
        argArray[_i - 1] = arguments[_i];
    }

The analysis runs before baseline compilation, so we have no template object for JSOP_NEWARRAY and IonBuilder uses MUnknownValue. 

IonBuilder::jsop_setelem then aborts because it thinks the value might be an optimized arguments object.
Attachment #8527703 - Flags: review?(bhackett1024)
Attachment #8527703 - Flags: review?(bhackett1024) → review+
https://hg.mozilla.org/mozilla-central/rev/111b2dd131cf
Status: ASSIGNED → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla36
You need to log in before you can comment on or make changes to this bug.