The default bug view has changed. See this FAQ.

IonMonkey: Fix StoreSlotT write barriers with unknown type information

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: sstangl, Unassigned)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

5 years ago
Created attachment 620068 [details] [diff] [review]
Fix

If the input to a StoreSlot is typed, but TI does not know the type of the slot, and write barriers are necessary, we crash due to trying to coerce MIRType_None into a JSValueType.

This just changes the default slot value to be MIRType_Value, and then puts machinery to convert that MIRType to JSVAL_TYPE_UNKNOWN. Fixes an --ion-eager failure.
Attachment #620068 - Flags: review?(dvander)
(Reporter)

Comment 1

5 years ago
Created attachment 620088 [details] [diff] [review]
Fix v2, using MIRType

Prevents changes to ValueFromMIRType() by just using the MIRType directly.
Attachment #620068 - Attachment is obsolete: true
Attachment #620068 - Flags: review?(dvander)
Attachment #620088 - Flags: review?(dvander)
Attachment #620088 - Flags: review?(dvander) → review+
(Reporter)

Comment 2

5 years ago
https://hg.mozilla.org/projects/ionmonkey/rev/04590b9cde4e
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Duplicate of this bug: 737297
You need to log in before you can comment on or make changes to this bug.