IonMonkey: not rejoining properly from invalidation within instanceof GetPropertyCache

NEW
Unassigned

Status

()

6 years ago
4 years ago

People

(Reporter: bhackett, Unassigned)

Tracking

Other Branch
x86
Mac OS X
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [ion:p2])

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
Created attachment 656845 [details] [diff] [review]
patch to trigger failure

JSOP_INSTANCEOF is implemented using a GetPropertyCache, and if the VM call made by that cache invalidates the calling code then the value pushed by the instanceof is incorrect.  The easiest way to reproduce this is to apply the attached patch, which will discard code when GetPropertyCache is called via instanceof.  This will cause several jit-tests to start failing, and also the following example:

function foo() {
  print(foo instanceof Function);
}
foo();

> js test.js
true

> js --ion-eager test.js
function () {
}
Urgh, I thought I had reasoned invalidation wouldn't happen normally. JSC splits INSTANCEOF into multiple opcodes which would make this a lot easier...
Not sure how hard it is to trigger this without the patch. Marking as lower priority for now.
Whiteboard: [ion:p2]
(Reporter)

Updated

6 years ago
Blocks: 814177
(Assignee)

Updated

4 years ago
Assignee: general → nobody
You need to log in before you can comment on or make changes to this bug.