Open Bug 1437103 Opened 2 years ago Updated Last year

[Meta] Spectre mitigations for object type checks


(Core :: JavaScript Engine: JIT, enhancement, P3)




Tracking Status
firefox60 --- affected


(Reporter: jandem, Unassigned)


(Depends on 4 open bugs, Blocks 1 open bug)


(Keywords: meta)

This includes:

* Ion object type barriers
* Ion shape/group/class guards
* Shape/group/class guards on the holder object in GetProp/GetName/GetElem ICs

We should have separate bugs for each of these.
Keywords: meta
Depends on: 1437483
Priority: -- → P1
Depends on: 1440394
Depends on: 1441182
Depends on: 1442561
Depends on: 1452134
Depends on: 1452136
Depends on: 1465448
Depends on: 1465450
Depends on: 1465459
Moving to p3 because no activity for at least 24 weeks.
See for more information
Priority: P1 → P3
You need to log in before you can comment on or make changes to this bug.