Open Bug 1913864 Opened 11 months ago Updated 7 months ago

CacheIR doesnt take into account whether lexical environment's property is within dynamic slots or not

Categories

(Core :: JavaScript Engine: JIT, defect, P3)

Product:
Core
Component:
JavaScript Engine: JIT
Type:
defect

Tracking

()

People

(Reporter: debadree333, Unassigned)

References

(Blocks 1 open bug)

Details

First example noted here: https://phabricator.services.mozilla.com/D219406, This can be reproduced as well by changing the number of reserved slots in LexicalEnvironmentObject here: https://searchfox.org/mozilla-central/source/js/src/vm/EnvironmentObject.h#765 and building the js shell with --enable-explicit-resource-management and then running ./mach jit-test, The problematic code site was found to be here: https://searchfox.org/mozilla-central/rev/53e68046298557fae0c922230b595bb6689bf587/js/src/jit/CacheIR.cpp#3477-3478

Severity: -- → S4
Type: enhancement → defect
Priority: -- → P3
Summary: CacheIR doesnt take into account whether dynamic slot is within fixed slots or not → CacheIR doesnt take into account whether lexical environment's property is within dynamic slots or not
Duplicate of this bug: 1913863
You need to log in before you can comment on or make changes to this bug.