Closed
Bug 749486
Opened 12 years ago
Closed 12 years ago
js::ToInt32 broken when it gets inlined
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
mozilla15
People
(Reporter: mjrosenb, Unassigned)
Details
Attachments
(1 file)
914 bytes,
patch
|
jbramley
:
review+
|
Details | Diff | Splinter Review |
This one is against m-i, not IonMonkey. The GNU asm blob that does the toInt32 conversion is correct, but it marks |d| as an input register, meaning that the value in those registers should remain unchanged. For the most part, since the function is nothing but that statement, this is fine. However, if the function gets inlined, gcc expects the (possibly not dead) value of d to remain unchanged, and in fact actively uses it after the call to ToInt32 in js_Array. By specifing d as input/output, gcc assumes that the value of d has been changed in some unexpected way, and therefor cannot be eliminated as being the same as the argument to the function when inlining.
Attachment #618898 -
Flags: review?(Jacob.Bramley)
Comment 1•12 years ago
|
||
Comment on attachment 618898 [details] [diff] [review] /home/mrosenberg/patches/fix_input-r1.patch Review of attachment 618898 [details] [diff] [review]: ----------------------------------------------------------------- Ooh, nasty! The fix looks good.
Attachment #618898 -
Flags: review?(Jacob.Bramley) → review+
Comment 2•12 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/04e00b912240
Status: NEW → RESOLVED
Closed: 12 years ago
Flags: in-testsuite-
Resolution: --- → FIXED
Target Milestone: --- → mozilla15
You need to log in
before you can comment on or make changes to this bug.
Description
•