Closed Bug 731142 Opened 10 years ago Closed 10 years ago

IonMonkey: MNot::specialization_ is not initialized

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Assigned: jandem)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

Attached patch PatchSplinter Review
The MNot::specialization_ field was uninitialized so foldsTo could sometimes incorrectly fold MNot. The patch just removes this field and changes foldsTo to use the operand type.

This fixes v8bench.
Attachment #601206 - Flags: review?(dvander)
Summary: IonMonkey: MNot::specialization_ is invalid in release builds → IonMonkey: MNot::specialization_ is not initialized
Comment on attachment 601206 [details] [diff] [review]
Patch

Err, did I just regress this? Anyway, nice catch.
Attachment #601206 - Flags: review?(dvander) → review+
Well, I r+'ed it ;)

http://hg.mozilla.org/projects/ionmonkey/rev/8e8ec3416e50
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.