As a security precaution, we have turned on the setting "Require API key authentication for API requests" for everyone. If this has broken something, please contact
Last Comment Bug 707899 - IonMonkey: load initialized length from elements vector
: IonMonkey: load initialized length from elements vector
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: Jan de Mooij [:jandem]
: Jason Orendorff [:jorendorff]
Depends on:
Blocks: IonMonkey
  Show dependency treegraph
Reported: 2011-12-06 01:17 PST by Jan de Mooij [:jandem]
Modified: 2011-12-08 00:04 PST (History)
2 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Patch (33.95 KB, patch)
2011-12-06 02:37 PST, Jan de Mooij [:jandem]
dvander: review+
Details | Diff | Splinter Review

Description User image Jan de Mooij [:jandem] 2011-12-06 01:17:18 PST
Now that ObjShrink landed, we have to load the initialized length from the slots vector instead of the object.
Comment 1 User image Jan de Mooij [:jandem] 2011-12-06 02:37:13 PST
Created attachment 579266 [details] [diff] [review]

This patch adds MElements to read obj->elements. A large part of the patch is renaming "slots" to "elements" for MLoadElement, MStoreElement and MInitializedLength. Now "slots" refers to property slots (obj->slots) and "elements" refers to dense array elements (obj->elements).
Comment 2 User image Jan de Mooij [:jandem] 2011-12-08 00:04:33 PST

Note You need to log in before you can comment on or make changes to this bug.