Closed
Bug 1623780
Opened 4 years ago
Closed 4 years ago
Template-object and iteration-result-object functions should deal in PlainObject*, not NativeObject* or JSObject*
Categories
(Core :: JavaScript Engine, task)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla76
| Tracking | Status | |
|---|---|---|
| firefox76 | --- | fixed |
People
(Reporter: Waldo, Assigned: Waldo)
Details
Attachments
(1 file)
No description provided.
|
Assignee | |
Comment 1•4 years ago
|
||
Pushed by jwalden@mit.edu: https://hg.mozilla.org/integration/autoland/rev/fa7dea62766c Make a bunch of template-object functions, fields, and variables use a more-precise |PlainObject*| type instead of |NativeObject*|. r=arai
|
||
Comment 3•4 years ago
|
||
| bugherder | ||
Status: ASSIGNED → RESOLVED
Closed: 4 years ago
status-firefox76:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla76
|
||
Comment 4•4 years ago
|
||
Could this have caused bug 1624276?
|
|
Assignee | |
Comment 5•4 years ago
|
||
Seems doubtful. In essence, this patch was changing one function to assert the value it returns has a narrower type than it previously returned, then returning that narrower type. Then, propagating that narrower type to all callers. At the machine code level, an optimized build might even be bit-for-bit identical. I would expect some patch that touches stack mechanics somewhere is a more likely culprit.
You need to log in
before you can comment on or make changes to this bug.
Description
•