1195298 - NewDenseArray throws for int32 values represented as doubles when called from baseline or IonMonkey

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Till Schneidereit [:till]]

The self-hosted implementation of Array#splice (bug 890329) was backed out in bug 1195030 because it broke gmail. The reason is that it the NewDenseArray intrinsic checks if the first argument is an int32, but baseline and Ion cause a double value to be passed in.

Test case, needs "--baseline-eager":

function t() {
	var o = {l: 0xfffffffff};
	var l = o.l - 0xffffffffe;
	var a = getSelfHostedValue('NewDenseArray');
	a(l);
}
t();
t();

(Note: storing one of the values used in the subtraction in an object is a required part of the test.)

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

Sorry for the delay.

Comment 2

[Till Schneidereit [:till]]

Comment on attachment 8651801 [details] [diff] [review]
Patch

Review of attachment 8651801 [details] [diff] [review]:
-----------------------------------------------------------------

Thank you!

::: js/src/jit-test/tests/basic/bug1195298.js
@@ +1,1 @@
> +function t() {

This needs jitflags to run with --baseline-eager, right?

Comment 3

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/36e7f7148cf8

Comment 4

[Jan de Mooij [:jandem]]

(In reply to Till Schneidereit [:till] from comment #2)
> This needs jitflags to run with --baseline-eager, right?

In automation we run jit tests with --baseline-eager. I usually avoid adding explicit annotations in such cases, also because forcing a specific flag can actually restrict the number of combinations we test.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/36e7f7148cf8