Closed
Bug 750894
Opened 13 years ago
Closed 13 years ago
IonMonkey: Fix StoreSlotT write barriers with unknown type information
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
People
(Reporter: sstangl, Unassigned)
References
Details
Attachments
(1 file, 1 obsolete file)
|
9.25 KB,
patch
|
dvander
:
review+
|
Details | Diff | Splinter Review |
If the input to a StoreSlot is typed, but TI does not know the type of the slot, and write barriers are necessary, we crash due to trying to coerce MIRType_None into a JSValueType.
This just changes the default slot value to be MIRType_Value, and then puts machinery to convert that MIRType to JSVAL_TYPE_UNKNOWN. Fixes an --ion-eager failure.
Attachment #620068 -
Flags: review?(dvander)
|
Reporter | |
Comment 1•13 years ago
|
||
Prevents changes to ValueFromMIRType() by just using the MIRType directly.
Attachment #620068 -
Attachment is obsolete: true
Attachment #620068 -
Flags: review?(dvander)
Attachment #620088 -
Flags: review?(dvander)
|
||
Updated•13 years ago
|
Attachment #620088 -
Flags: review?(dvander) → review+
|
|
Reporter | |
Comment 2•13 years ago
|
||
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•