1207210 - MTypeBarrier::alwaysBails returns true for ObjectOrNull -> Null barrier

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Jan de Mooij [:jandem]]

Attachment: Patch

This is causing a ton of bailouts on Octane-richards.

Comment 1

[Hannes Verschore [:h4writer]]

Comment on attachment 8664282 [details] [diff] [review]
Patch

Review of attachment 8664282 [details] [diff] [review]:
-----------------------------------------------------------------

Nice find!

::: js/src/jit/MIR.h
@@ +12427,5 @@
>              return false;
>          if (input()->type() == MIRType_Value)
>              return false;
> +        if (input()->type() == MIRType_ObjectOrNull) {
> +            MOZ_ASSERT(type == MIRType_Null);

Can you mention here that the ObjectNull optimization currently is only applied when 
the type is MIRType_Null ? To justify why we assert MIRType_Null here.

Comment 2

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9383690a4acd

Comment 3

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/9383690a4acd