581256 - JM: mochitest-plain failure on test_MochiKit-color.html

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[David Mandelin [:dmandelin]]

343 ERROR TEST-UNEXPECTED-FAIL | /tests/MochiKit-1.4.2/tests/test_MochiKit-Color.html | rgba output correctly - got "rgba(undefined,0.5)", expected "rgba(0,255,255,0.5)"

Comment 1

[David Mandelin [:dmandelin]]

Attachment: Patch

Cause: The compiler assumes that the JS frame is fully materialized (every value fully sync'd to memory) at control-flow branches and merges. This wasn't true along the slow path for relational-op/branch fused ops. In particular, a type tag wasn't being sync'd, causing a value to get the wrong type when reloaded from the frame.

The fix has two aspects:

- Before the slow call for relop/branch, sync the entire frame instead of just the top 2 stack elements.
- Any time we sync a data value, also sync the type tag.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 459978 [details] [diff] [review]
Patch

After reading ImmutableSync, I think it's okay, and this patch is enough. Thanks for taking.

Comment 3

[David Mandelin [:dmandelin]]

http://hg.mozilla.org/users/danderson_mozilla.com/moo/rev/256863e70bf1
http://hg.mozilla.org/projects/jaegermonkey/rev/256863e70bf1

Looks like a 10ms slowdown on SunSpider on a fast machine.