Closed Bug 750894 Opened 9 years ago Closed 9 years ago

IonMonkey: Fix StoreSlotT write barriers with unknown type information

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: sstangl, Unassigned)

References

Details

Attachments

(1 file, 1 obsolete file)

Attached patch Fix (obsolete) — Splinter Review
If the input to a StoreSlot is typed, but TI does not know the type of the slot, and write barriers are necessary, we crash due to trying to coerce MIRType_None into a JSValueType.

This just changes the default slot value to be MIRType_Value, and then puts machinery to convert that MIRType to JSVAL_TYPE_UNKNOWN. Fixes an --ion-eager failure.
Attachment #620068 - Flags: review?(dvander)
Prevents changes to ValueFromMIRType() by just using the MIRType directly.
Attachment #620068 - Attachment is obsolete: true
Attachment #620068 - Flags: review?(dvander)
Attachment #620088 - Flags: review?(dvander)
Attachment #620088 - Flags: review?(dvander) → review+
https://hg.mozilla.org/projects/ionmonkey/rev/04590b9cde4e
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Duplicate of this bug: 737297
You need to log in before you can comment on or make changes to this bug.