Closed
Bug 1140888
Opened 10 years ago
Closed 10 years ago
Properly invalidate Ion code after converting unboxed objects to natives
Categories
(Core :: JavaScript Engine: JIT, defect)
Tracking
()
RESOLVED
FIXED
mozilla39
| Tracking | Status | |
|---|---|---|
| firefox39 | --- | fixed |
People
(Reporter: bhackett1024, Assigned: bhackett1024)
References
Details
Attachments
(1 file)
|
1.11 KB,
patch
|
jandem
:
review+
|
Details | Diff | Splinter Review |
Bug 1133254 added a mechanism for invalidating Ion code after an unboxed object with some group is converted to a native. Unfortunately, I forgot to ever invoke this mechanism, so Ion code depending on the unboxed layout might not be invalidated properly. This has been causing octane-typescript to crash on AWFY when using unboxed objects for the last several days. The attached patch fixes this and adds a test.
Attachment #8574431 -
Flags: review?(jdemooij)
|
||
Updated•10 years ago
|
Attachment #8574431 -
Flags: review?(jdemooij) → review+
|
Assignee | |
Comment 1•10 years ago
|
||
Assignee: nobody → bhackett1024
Status: NEW → RESOLVED
Closed: 10 years ago
status-firefox39:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla39
You need to log in
before you can comment on or make changes to this bug.
Description
•