Closed Bug 723791 Opened 13 years ago Closed 13 years ago

fun_getProperty needs a method barrier

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla13

People

(Reporter: luke, Assigned: luke)

Details

Attachments

(2 files)

When fun_getProperty searches the call stack for a matching callee (matching 'f' in f.arguments), it needs to use the method barrier. Otherwise, it may miss the innermost frame. This was the *real* cause of bug 721322. The patch in bug 721322, by noting arguments usage, I think just turned off the method optimization. Most of that patch can actually be removed: read-only access to the arguments object via f.arguments may happen at any time and will faithfully return the correct current argument value.
Assignee: general → luke
Status: NEW → ASSIGNED
Attachment #594050 - Flags: review?(jorendorff)
... because it isn't needed. I verified that the tests added by bug 721322 fail with this patch applied (but not the fix patch) and are fixed when the fix patch is applied.
Attachment #594051 - Flags: review?(jorendorff)
Comment on attachment 594050 [details] [diff] [review] add the method guard Certainly this seems like a strict improvement...
Attachment #594050 - Flags: review?(jorendorff) → review+
Comment on attachment 594051 [details] [diff] [review] remove noteArgumentsPropertyAccess ...and OK, this is fine. You could back out more of the patch in bug 721322: it contains some renaming that you haven't reverted. Your call.
Attachment #594051 - Flags: review?(jorendorff) → review+
I left the renaming b/c it will be removed with a later patch. (We already do a strictly-more powerful analysis to determine when arguments are used for optimization purposes; with that combined with eager arguments creation, strict arguments should just fall out.)
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: