1762582 - MacroAssembler::branchIfNotFunctionIsNonBuiltinCtor

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[André Bargull [:anba]]

branchIfNotFunctionIsNonBuiltinCtor wasn't updated in bug 1724031.

Test case:

function f() {
  function C() {}
  C.prototype = null;
}
for (let i = 0; i < 10000; ++i) f();

When running with IONFLAGS=bl-ic-fb shows that the fallback path is always taken.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1724031

Comment 2

[André Bargull [:anba]]

Attachment: Bug 1762582 - Part 1: Fix MacroAssembler::branchIfNotFunctionIsNonBuiltinCtor. r=jonco!

Comment 3

[André Bargull [:anba]]

Attachment: Bug 1762582 - Part 2: Add MacroAssembler::loadFunctionArgCount(). r=jonco!

Add a helper function to centralise loading the function arguments count.

Depends on D142674

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/322cfbb1ffdc
Part 1: Fix MacroAssembler::branchIfNotFunctionIsNonBuiltinCtor. r=jonco
https://hg.mozilla.org/integration/autoland/rev/d8bcd71ed8fc
Part 2: Add MacroAssembler::loadFunctionArgCount(). r=jonco

Comment 5

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/322cfbb1ffdc
https://hg.mozilla.org/mozilla-central/rev/d8bcd71ed8fc

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:anba, is this bug important enough to require an uplift?
If not please set status_beta to wontfix.

For more information, please visit auto_nag documentation.