js::ToInt32 broken when it gets inlined

RESOLVED FIXED in mozilla15

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: mjrosenb, Unassigned)

Tracking

unspecified
mozilla15
ARM
Linux
Points:
---
Bug Flags:
in-testsuite -

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
Created attachment 618898 [details] [diff] [review]
/home/mrosenberg/patches/fix_input-r1.patch

This one is against m-i, not IonMonkey.  The GNU asm blob that does the toInt32 conversion is correct, but it marks |d| as an input register, meaning that the value in those registers should remain unchanged.  For the most part, since the function is nothing but that statement, this is fine.  However, if the function gets inlined, gcc expects the (possibly not dead) value of d to remain unchanged, and in fact actively uses it after the call to ToInt32 in js_Array.  By specifing d as input/output, gcc assumes that the value of d has been changed in some unexpected way, and therefor cannot be eliminated as being the same as the argument to the function when inlining.
Attachment #618898 - Flags: review?(Jacob.Bramley)
Comment on attachment 618898 [details] [diff] [review]
/home/mrosenberg/patches/fix_input-r1.patch

Review of attachment 618898 [details] [diff] [review]:
-----------------------------------------------------------------

Ooh, nasty!

The fix looks good.
Attachment #618898 - Flags: review?(Jacob.Bramley) → review+
http://hg.mozilla.org/mozilla-central/rev/04e00b912240
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Flags: in-testsuite-
Resolution: --- → FIXED
Target Milestone: --- → mozilla15
You need to log in before you can comment on or make changes to this bug.