821692 - BaselineCompiler: Compile NEWARRAY

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

Comment 2

[Kannan Vijayan [:djvj]]

Comment on attachment 692295 [details] [diff] [review]
Patch

Review of attachment 692295 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/ion/BaselineIC.cpp
@@ +530,5 @@
> +{
> +    RawObject obj = NewInitArray(cx, length, type);
> +    if (!obj)
> +        return false;
> +

Need to monitor result of NewInitArray

::: js/src/ion/BaselineIC.h
@@ +1113,5 @@
> +            return ICNewArray_Fallback::New(space, getStubCode());
> +        }
> +    };
> +};
> +

The result of JSOP_NEWARRAY is monitored in the interpreter.  We probably want this to be a ICMonitoredFallbackStub.

Comment 3

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/projects/ionmonkey/rev/c73c841fa22e

(In reply to Kannan Vijayan [:djvj] from comment #2)
> 
> Need to monitor result of NewInitArray

NewInitArray calls TypeScript::Monitor in the UseNewTypeForInitializer case. In the other cases we can get the TypeObject from the script + pc.