787050 - IonMonkey: not rejoining properly from invalidation within instanceof GetPropertyCache

Status: NEW

(Core :: JavaScript Engine, defect)

Description

[Brian Hackett [Laid off!]]

Attachment: patch to trigger failure

JSOP_INSTANCEOF is implemented using a GetPropertyCache, and if the VM call made by that cache invalidates the calling code then the value pushed by the instanceof is incorrect.  The easiest way to reproduce this is to apply the attached patch, which will discard code when GetPropertyCache is called via instanceof.  This will cause several jit-tests to start failing, and also the following example:

function foo() {
  print(foo instanceof Function);
}
foo();

> js test.js
true

> js --ion-eager test.js
function () {
}

Comment 1

[David Anderson [:dvander] - inactive, e-mail if emergency]

Urgh, I thought I had reasoned invalidation wouldn't happen normally. JSC splits INSTANCEOF into multiple opcodes which would make this a lot easier...

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Not sure how hard it is to trigger this without the patch. Marking as lower priority for now.