1104027 - SETELEM can abort IonBuilder arguments analysis

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Jan de Mooij [:jandem]]

Attachment: Patch

Till noticed that the arguments analysis doesn't work for a function with a loop like this:

    var argArray = [];
    for (var _i = 1; _i < arguments.length; _i++) {
        argArray[_i - 1] = arguments[_i];
    }

The analysis runs before baseline compilation, so we have no template object for JSOP_NEWARRAY and IonBuilder uses MUnknownValue. 

IonBuilder::jsop_setelem then aborts because it thinks the value might be an optimized arguments object.

Comment 1

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/111b2dd131cf

Comment 2

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/111b2dd131cf