Closed Bug 833340 Opened 7 years ago Closed 7 years ago

Fix a couple of jittests failing with rooting analysis

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set

Tracking

()

RESOLVED FIXED
mozilla21

People

(Reporter: jonco, Assigned: jonco)

References

Details

Attachments

(1 file)

Currently I see the following jittests failing with rooting analysis turned on:

    /home/jon/work/dev/tree/js/src/jit-test/tests/auto-regress/bug599464.js
    /home/jon/work/dev/tree/js/src/jit-test/tests/auto-regress/bug600128.js
    /home/jon/work/dev/tree/js/src/jit-test/tests/auto-regress/bug607502.js
    /home/jon/work/dev/tree/js/src/jit-test/tests/auto-regress/bug607513.js
    /home/jon/work/dev/tree/js/src/jit-test/tests/auto-regress/bug638212.js
    /home/jon/work/dev/tree/js/src/jit-test/tests/basic/bug698584.js
    /home/jon/work/dev/tree/js/src/jit-test/tests/basic/testBug507425.js
    /home/jon/work/dev/tree/js/src/jit-test/tests/basic/testOverRecursed4.js
    /home/jon/work/dev/tree/js/src/jit-test/tests/ion/bug827821-2.js
Attached patch Proposed fixSplinter Review
Attachment #704884 - Flags: review?(terrence)
Comment on attachment 704884 [details] [diff] [review]
Proposed fix

All jittests pass with the above patch.

The change to ConcatStringsMaybeAllowGC could perhaps be clearer, but I didn't immediately see a way to do this.
Blocks: 745742
Comment on attachment 704884 [details] [diff] [review]
Proposed fix

Review of attachment 704884 [details] [diff] [review]:
-----------------------------------------------------------------

Excellent!

::: js/src/jsscope.cpp
@@ +1054,5 @@
>       * initialized length and capacity of the object to zero and ensure that no
>       * new dense elements can be added without calling growElements(), which
>       * checks isExtensible().
>       */
> +    if (self->isNative() && !JSObject::sparsifyDenseElements(cx, self))

Ah, this is bug 830586. Please resolve it duplicate to this  bug.

::: js/src/vm/String.cpp
@@ +314,5 @@
>          return left;
>  
>      size_t wholeLength = leftLen + rightLen;
> +    JSContext *cxIfCanGC = allowGC ? cx : NULL;
> +    if (!JSString::validateLength(cxIfCanGC, wholeLength))

Thanks, that's way better. Please also change the name of validateLength's |cx| argument to |maybecx|.
Attachment #704884 - Flags: review?(terrence) → review+
Duplicate of this bug: 830586
https://hg.mozilla.org/mozilla-central/rev/38cf4fcc0187
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla21
You need to log in before you can comment on or make changes to this bug.