Closed Bug 793284 Opened 7 years ago Closed 7 years ago

IonMonkey: TestCommonPropFunc() may cause bogus invalidations

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set

Tracking

()

RESOLVED FIXED
mozilla18

People

(Reporter: efaust, Assigned: efaust)

References

Details

(Whiteboard: [ion:t])

Attachments

(1 file)

For some reasons, TestCommonPropFunc() calls TypeSet::isOwnProperty() instead of TypeSet::ownProperty() to do preliminary checks, leaving behind potentially bogus constraints which may lead to invalidation.
Attached patch PatchSplinter Review
Comment on attachment 663533 [details] [diff] [review]
Patch

ownProperty() checks the same flags without adding the freeze. Applies on top of current !isOwn fix from bug 792166
Attachment #663533 - Attachment is patch: true
Attachment #663533 - Flags: review?(kvijayan)
Attachment #663533 - Flags: review?(kvijayan) → review+
https://hg.mozilla.org/mozilla-central/rev/19da37cf65ae
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla18
You need to log in before you can comment on or make changes to this bug.