Closed
Bug 745236
Opened 12 years ago
Closed 12 years ago
fix f.apply(arguments) optimization bugs
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla14
People
(Reporter: luke, Assigned: luke)
Details
Attachments
(2 files)
1.72 KB,
patch
|
bhackett1024
:
review+
lsblakk
:
approval-mozilla-central+
|
Details | Diff | Splinter Review |
1.72 KB,
patch
|
bhackett1024
:
review+
lsblakk
:
approval-mozilla-central+
|
Details | Diff | Splinter Review |
I realized this morning that bug 740446 mishandles two corner cases with the f.apply(arguments) optimization stemming from the use of ssa instead of bytecode pattern-matching. Insane test-cases, but trivial fixes.
Assignee | ||
Comment 1•12 years ago
|
||
Because a magic value can be left on the stack even after applySpeculationFailed, it is possible to call applySpeculationFailed even when needsArgsObj is true.
Attachment #614841 -
Flags: review?(bhackett1024)
Assignee | ||
Comment 2•12 years ago
|
||
If 'arguments' is overwritten, we don't want to clobber it in applySpeculationFailed.
Attachment #614842 -
Flags: review?(bhackett1024)
Updated•12 years ago
|
Attachment #614841 -
Flags: review?(bhackett1024) → review+
Assignee | ||
Comment 3•12 years ago
|
||
(Note: there is one more fix to review)
Comment 4•12 years ago
|
||
Comment on attachment 614842 [details] [diff] [review] fix 2 Ah, yeah, meant to review both and got distracted.
Attachment #614842 -
Flags: review?(bhackett1024) → review+
Assignee | ||
Updated•12 years ago
|
Attachment #614841 -
Flags: approval-mozilla-central?
Assignee | ||
Updated•12 years ago
|
Attachment #614842 -
Flags: approval-mozilla-central?
Comment 5•12 years ago
|
||
Comment on attachment 614841 [details] [diff] [review] fix 1 [triage comment] low/no risk to mobile.
Attachment #614841 -
Flags: approval-mozilla-central? → approval-mozilla-central+
Updated•12 years ago
|
Attachment #614842 -
Flags: approval-mozilla-central? → approval-mozilla-central+
Assignee | ||
Comment 6•12 years ago
|
||
https://hg.mozilla.org/integration/mozilla-inbound/rev/02abd512e339 https://hg.mozilla.org/integration/mozilla-inbound/rev/19f452f79198
Target Milestone: --- → mozilla14
Comment 7•12 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/02abd512e339 https://hg.mozilla.org/mozilla-central/rev/19f452f79198
Status: ASSIGNED → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•