IonMonkey: branchTestObjShape ignores input Condition and always uses "NotEqual"

RESOLVED FIXED in mozilla20

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: djvj, Unassigned)

Tracking

unspecified
mozilla20
x86
Mac OS X
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
See IonMacroAssembler.h/branchTestObjShape.

Arguments include a condition |cond|, but the actual condition implemented is always NotEqual.  This hasn't surfaced yet since all uses of branchTestObjShape currently use NotEqual.
(Reporter)

Comment 1

5 years ago
Created attachment 686777 [details] [diff] [review]
Fix.
Attachment #686777 - Flags: review?(mrosenberg)
Comment on attachment 686777 [details] [diff] [review]
Fix.

Review of attachment 686777 [details] [diff] [review]:
-----------------------------------------------------------------

whoops, that was almost certainly my bad.
Attachment #686777 - Flags: review?(mrosenberg) → review+
https://hg.mozilla.org/mozilla-central/rev/2d3c0823f7c2
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla20
You need to log in before you can comment on or make changes to this bug.