The default bug view has changed. See this FAQ.

IonMonkey: TestCommonPropertyFunc() adds overzealous MGuardShape

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: efaust, Assigned: efaust)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

5 years ago
TestCommonPropertyFunc() keeps track of the shape * that the property was actually found on, and guards on that. This is overzealous. The property is almost certainly not the last one added, so this will bailout more often than necessary.
(Assignee)

Comment 1

5 years ago
Created attachment 637434 [details] [diff] [review]
Fix
Attachment #637434 - Flags: review?(jdemooij)
Comment on attachment 637434 [details] [diff] [review]
Fix

Review of attachment 637434 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/IonBuilder.cpp
@@ +4711,2 @@
>          } else if (foundProto != proto)
>              return true;

Nit: single-line "if" now so no longer needs braces.
Attachment #637434 - Flags: review?(jdemooij) → review+
(Assignee)

Comment 3

5 years ago
https://hg.mozilla.org/projects/ionmonkey/rev/4f57f42dc238

Changed from guarding on the shape we found the property on to the shape of the object.
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.