MacroAssembler::branchTestObjCompartment needs to guard on the compartment instead of realm

RESOLVED FIXED in Firefox 62

Status

()

enhancement
RESOLVED FIXED
Last year
Last year

People

(Reporter: jandem, Assigned: jandem)

Tracking

unspecified
mozilla62
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox62 fixed)

Details

Attachments

(1 attachment)

Posted patch PatchSplinter Review
I just realized bug 1363214 broke this because the guard is always false if we compare a JSCompartment* to obj->group->realm_. I think it's okay for this code to guard on the compartment and to accept same-realm compartments.
Attachment #8983786 - Flags: review?(tcampbell)
Note that this introduces an extra load. I think that's fine and we should be able to remove these ICs eventually anyway.
(In reply to Jan de Mooij [:jandem] from comment #0)
> guard on the compartment and to accept same-realm compartments.

Er, same-compartment realms :)
Comment on attachment 8983786 [details] [diff] [review]
Patch

Review of attachment 8983786 [details] [diff] [review]:
-----------------------------------------------------------------

Good find. Extra load is likely fine as these ICs are already complicated.
Attachment #8983786 - Flags: review?(tcampbell) → review+
Pushed by jandemooij@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/7b760c430347
Fix MacroAssembler::branchTestObjCompartment to guard on realm->compartment instead of realm. r=tcampbell
https://hg.mozilla.org/mozilla-central/rev/7b760c430347
Status: ASSIGNED → RESOLVED
Closed: Last year
Resolution: --- → FIXED
Target Milestone: --- → mozilla62
You need to log in before you can comment on or make changes to this bug.