Closed Bug 749486 Opened 9 years ago Closed 9 years ago

js::ToInt32 broken when it gets inlined

Categories

(Core :: JavaScript Engine, defect)

ARM
Linux
defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla15

People

(Reporter: mjrosenb, Unassigned)

Details

Attachments

(1 file)

This one is against m-i, not IonMonkey.  The GNU asm blob that does the toInt32 conversion is correct, but it marks |d| as an input register, meaning that the value in those registers should remain unchanged.  For the most part, since the function is nothing but that statement, this is fine.  However, if the function gets inlined, gcc expects the (possibly not dead) value of d to remain unchanged, and in fact actively uses it after the call to ToInt32 in js_Array.  By specifing d as input/output, gcc assumes that the value of d has been changed in some unexpected way, and therefor cannot be eliminated as being the same as the argument to the function when inlining.
Attachment #618898 - Flags: review?(Jacob.Bramley)
Comment on attachment 618898 [details] [diff] [review]
/home/mrosenberg/patches/fix_input-r1.patch

Review of attachment 618898 [details] [diff] [review]:
-----------------------------------------------------------------

Ooh, nasty!

The fix looks good.
Attachment #618898 - Flags: review?(Jacob.Bramley) → review+
http://hg.mozilla.org/mozilla-central/rev/04e00b912240
Status: NEW → RESOLVED
Closed: 9 years ago
Flags: in-testsuite-
Resolution: --- → FIXED
Target Milestone: --- → mozilla15
You need to log in before you can comment on or make changes to this bug.