485502 - Pointer target goes out of scope.

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jacob Bramley [:jbramley]]

Note: This is a bug that was introduced as a result of the patches for bug #480796. However, as that bug has already checked in, I wasn't sure whether I should add a comment there or create a new bug.

The LIR file (nanojit/LIR.cpp) creates an array for soft float arguments and then redirects the old "args" pointer to point to it. This worked fine when the preprocessor was used to conditionally include this code. However, now that this check is done at run-time, the new array is allocated on the stack inside an "if" statement. Of course, after the block, the array is out of scope.

The offending change is linked here: https://bugzilla.mozilla.org/attachment.cgi?id=368150&action=diff#a/js/src/nanojit/LIR.cpp_sec1

Comment 1

[Brendan Eich [:brendan]]

Regressor blocks regressee, so anyone cherry-picking the latter knows they need to take the former.

/be

Comment 2

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

This is fixed by bug 484606 -- the code goes away entirely.

Comment 3

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Should be fixed by bug 484606 checkin.