802384 - IonMonkey: Bug in GeneratePrototypeGuards in IonCache.cpp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Kannan Vijayan [:djvj]]

The |GeneratePrototypeGuards| function in IonCaches.cpp, in the case where an object in the prototype chain has an uncacheable prototype, and also has a singleton type, incorrectly checks the prototype against 'obj->proto()' (which will remain the same for all loop iterations), as opposed to 'pobj->proto()'.

Looking at the code which marks objects as having uncacheble prototypes, it seems that an object will never be marked as having an uncacheable prototype if it has a singleton type.

This incorrect code will never get executed because the two conditions it executes under are never both true.  Suggest replacing the entire block with a |JS_ASSERT(!pobj->hasSingletonType())|.

Comment 1

[Kannan Vijayan [:djvj]]

Attachment: Patch

Patch passes jstests and jit-tests with debug build ion 64-bit linux.

Running through try:
https://tbpl.mozilla.org/?tree=Try&rev=32796e87970d

Comment 2

[Kannan Vijayan [:djvj]]

Comment on attachment 672052 [details] [diff] [review]
Patch

Tbpl looks clean enough.

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/8559d650b22d