Last Comment Bug 750894 - IonMonkey: Fix StoreSlotT write barriers with unknown type information
: IonMonkey: Fix StoreSlotT write barriers with unknown type information
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: All All
: -- normal (vote)
: ---
Assigned To: general
:
: Jason Orendorff [:jorendorff]
Mentors:
: 737297 (view as bug list)
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2012-05-01 14:42 PDT by Sean Stangl [:sstangl]
Modified: 2012-05-01 17:59 PDT (History)
2 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Fix (2.13 KB, patch)
2012-05-01 14:42 PDT, Sean Stangl [:sstangl]
no flags Details | Diff | Splinter Review
Fix v2, using MIRType (9.25 KB, patch)
2012-05-01 15:15 PDT, Sean Stangl [:sstangl]
dvander: review+
Details | Diff | Splinter Review

Description Sean Stangl [:sstangl] 2012-05-01 14:42:04 PDT
Created attachment 620068 [details] [diff] [review]
Fix

If the input to a StoreSlot is typed, but TI does not know the type of the slot, and write barriers are necessary, we crash due to trying to coerce MIRType_None into a JSValueType.

This just changes the default slot value to be MIRType_Value, and then puts machinery to convert that MIRType to JSVAL_TYPE_UNKNOWN. Fixes an --ion-eager failure.
Comment 1 Sean Stangl [:sstangl] 2012-05-01 15:15:19 PDT
Created attachment 620088 [details] [diff] [review]
Fix v2, using MIRType

Prevents changes to ValueFromMIRType() by just using the MIRType directly.
Comment 2 Sean Stangl [:sstangl] 2012-05-01 16:18:06 PDT
https://hg.mozilla.org/projects/ionmonkey/rev/04590b9cde4e
Comment 3 Nicolas B. Pierron [:nbp] 2012-05-01 17:59:32 PDT
*** Bug 737297 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.