Closed Bug 1467142 Opened 3 years ago Closed 3 years ago

MacroAssembler::branchTestObjCompartment needs to guard on the compartment instead of realm

Categories

(Core :: JavaScript Engine: JIT, enhancement)

enhancement
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla62
Tracking Status
firefox62 --- fixed

People

(Reporter: jandem, Assigned: jandem)

References

Details

Attachments

(1 file)

Attached patch PatchSplinter Review
I just realized bug 1363214 broke this because the guard is always false if we compare a JSCompartment* to obj->group->realm_. I think it's okay for this code to guard on the compartment and to accept same-realm compartments.
Attachment #8983786 - Flags: review?(tcampbell)
Note that this introduces an extra load. I think that's fine and we should be able to remove these ICs eventually anyway.
(In reply to Jan de Mooij [:jandem] from comment #0)
> guard on the compartment and to accept same-realm compartments.

Er, same-compartment realms :)
Comment on attachment 8983786 [details] [diff] [review]
Patch

Review of attachment 8983786 [details] [diff] [review]:
-----------------------------------------------------------------

Good find. Extra load is likely fine as these ICs are already complicated.
Attachment #8983786 - Flags: review?(tcampbell) → review+
Pushed by jandemooij@gmail.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/7b760c430347
Fix MacroAssembler::branchTestObjCompartment to guard on realm->compartment instead of realm. r=tcampbell
https://hg.mozilla.org/mozilla-central/rev/7b760c430347
Status: ASSIGNED → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla62
You need to log in before you can comment on or make changes to this bug.