Open Bug 1437103 Opened 2 years ago Updated Last year

[Meta] Spectre mitigations for object type checks

Categories

(Core :: JavaScript Engine: JIT, enhancement, P3)

enhancement

Tracking

()

Tracking Status
firefox60 --- affected

People

(Reporter: jandem, Unassigned)

References

(Depends on 4 open bugs, Blocks 1 open bug)

Details

(Keywords: meta)

This includes:

* Ion object type barriers
* Ion shape/group/class guards
* Shape/group/class guards on the holder object in GetProp/GetName/GetElem ICs

We should have separate bugs for each of these.
Keywords: meta
Depends on: 1437483
Priority: -- → P1
Depends on: 1440394
Depends on: 1441182
Depends on: 1442561
Depends on: 1452134
Depends on: 1452136
Depends on: 1465448
Depends on: 1465450
Depends on: 1465459
Moving to p3 because no activity for at least 24 weeks.
See https://github.com/mozilla/bug-handling/blob/master/policy/triage-bugzilla.md#how-do-you-triage for more information
Priority: P1 → P3
You need to log in before you can comment on or make changes to this bug.