fix f.apply(arguments) optimization bugs

RESOLVED FIXED in mozilla14

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: luke, Assigned: luke)

Tracking

unspecified
mozilla14
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Assignee)

Description

5 years ago
I realized this morning that bug 740446 mishandles two corner cases with the f.apply(arguments) optimization stemming from the use of ssa instead of bytecode pattern-matching.  Insane test-cases, but trivial fixes.
(Assignee)

Comment 1

5 years ago
Created attachment 614841 [details] [diff] [review]
fix 1

Because a magic value can be left on the stack even after applySpeculationFailed, it is possible to call applySpeculationFailed even when needsArgsObj is true.
Attachment #614841 - Flags: review?(bhackett1024)
(Assignee)

Comment 2

5 years ago
Created attachment 614842 [details] [diff] [review]
fix 2

If 'arguments' is overwritten, we don't want to clobber it in applySpeculationFailed.
Attachment #614842 - Flags: review?(bhackett1024)
Attachment #614841 - Flags: review?(bhackett1024) → review+
(Assignee)

Comment 3

5 years ago
(Note: there is one more fix to review)
Comment on attachment 614842 [details] [diff] [review]
fix 2

Ah, yeah, meant to review both and got distracted.
Attachment #614842 - Flags: review?(bhackett1024) → review+
(Assignee)

Updated

5 years ago
Attachment #614841 - Flags: approval-mozilla-central?
(Assignee)

Updated

5 years ago
Attachment #614842 - Flags: approval-mozilla-central?
Comment on attachment 614841 [details] [diff] [review]
fix 1

[triage comment]
low/no risk to mobile.
Attachment #614841 - Flags: approval-mozilla-central? → approval-mozilla-central+
Attachment #614842 - Flags: approval-mozilla-central? → approval-mozilla-central+
(Assignee)

Comment 6

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/02abd512e339
https://hg.mozilla.org/integration/mozilla-inbound/rev/19f452f79198
Target Milestone: --- → mozilla14
https://hg.mozilla.org/mozilla-central/rev/02abd512e339
https://hg.mozilla.org/mozilla-central/rev/19f452f79198
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.