Closed Bug 1604760 Opened 6 years ago Closed 6 years ago

Remove unreachable code in JSFunction::isDerivedClassConstructor testing for self-hosted lazy scripts

Categories

(Core :: JavaScript Engine, task, P2)

task

Tracking

()

RESOLVED FIXED
mozilla73
Tracking Status
firefox73 --- fixed

People

(Reporter: anba, Assigned: anba)

Details

Attachments

(1 file)

Default class constructors have their SELF_HOSTED flag cleared in js::MakeDefaultConstructor, which means JSFunction::hasSelfHostedLazyScript() when called in JSFunction::isDerivedClassConstructor always returns false, cf. hasSelfHostedLazyScript and isSelfHostedOrIntrinsic:

bool hasSelfHostedLazyScript() const {
  return isInterpretedLazy() && isSelfHostedOrIntrinsic();
}

bool isSelfHostedOrIntrinsic() const {
  return hasFlags(SELF_HOSTED);
}

Additionally assert we don't try to relazify default class constructors, so it's
more clear we don't have to worry about this case in isDerivedClassConstructor().

We don't relaziy default class constructors, because JSScript::canRelazify()
returns false for these functions. canRelazify() requires either a lazy
script (default class constructors originate from self-hosted code, so they
don't have a lazy script) or a script with ImmutableFlags::SelfHosted set.
But ImmutableFlags::SelfHosted is cleared from default class constructors in
JSScript::setDefaultClassConstructorSpan().

Priority: -- → P2
Pushed by ccoroiu@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/a52aae1039fc Remove unreachable code in JSFunction::isDerivedClassConstructor testing for self-hosted lazy scripts. r=tcampbell
Status: ASSIGNED → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla73
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: