Closed Bug 1518127 Opened 8 months ago Closed 8 months ago

Result type can never be ObjectOrNull in MGuardToClass

Categories

(Core :: JavaScript Engine: JIT, enhancement, P3)

enhancement

Tracking

()

RESOLVED FIXED
mozilla66
Tracking Status
firefox66 --- fixed

People

(Reporter: anba, Assigned: anba)

Details

Attachments

(1 file)

The |MIRType::ObjectOrNull| case in [1] can never be true, because |IonBuilder::getInlineReturnType()| never returns |MIRType::ObjectOrNull|.

[1] https://searchfox.org/mozilla-central/rev/f8de61826903996f6bdf41b11a2844dd59ac144f/js/src/jit/MCallOptimize.cpp#2809
Attached patch bug1518127.patchSplinter Review
The result type for MGuardToClass is always |MIRType::Object|, so remove any other code which handles the case when the result type is not |MIRType::Object|. Also change the assertion in MGuardToClass' constructor to only accept an input which is of type MIRType::Object, which matches the only passed input type to MGuardToClass, cf. <https://searchfox.org/mozilla-central/rev/f8de61826903996f6bdf41b11a2844dd59ac144f/js/src/jit/MCallOptimize.cpp#2805-2807>.
Attachment #9034716 - Flags: review?(tcampbell)
Comment on attachment 9034716 [details] [diff] [review]
bug1518127.patch

Review of attachment 9034716 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks for the explanation!
Attachment #9034716 - Flags: review?(tcampbell) → review+

Pushed by btara@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/96da0c4e18f9
Remove unreachable code in MGuardToClass. r=tcampbell

Keywords: checkin-needed
Priority: -- → P3
Status: ASSIGNED → RESOLVED
Closed: 8 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla66
You need to log in before you can comment on or make changes to this bug.