Closed Bug 821692 Opened 10 years ago Closed 10 years ago

BaselineCompiler: Compile NEWARRAY

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: jandem, Assigned: jandem)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

No description provided.
Attached patch PatchSplinter Review
Attachment #692295 - Flags: review?(kvijayan)
Comment on attachment 692295 [details] [diff] [review]
Patch

Review of attachment 692295 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/BaselineIC.cpp
@@ +530,5 @@
> +{
> +    RawObject obj = NewInitArray(cx, length, type);
> +    if (!obj)
> +        return false;
> +

Need to monitor result of NewInitArray

::: js/src/ion/BaselineIC.h
@@ +1113,5 @@
> +            return ICNewArray_Fallback::New(space, getStubCode());
> +        }
> +    };
> +};
> +

The result of JSOP_NEWARRAY is monitored in the interpreter.  We probably want this to be a ICMonitoredFallbackStub.
Attachment #692295 - Flags: review?(kvijayan) → review+
https://hg.mozilla.org/projects/ionmonkey/rev/c73c841fa22e

(In reply to Kannan Vijayan [:djvj] from comment #2)
> 
> Need to monitor result of NewInitArray

NewInitArray calls TypeScript::Monitor in the UseNewTypeForInitializer case. In the other cases we can get the TypeObject from the script + pc.
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.