840924 - BaselineCompiler: Fix earley-boyer failure

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

V8-earley currently fails:

$ ./js run-earley-boyer.js 
EarleyBoyer: TypeError: al is null

The copy in jit-tests passes and the test works with --no-ion, so it's probably related to bailouts from Ion.

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Patch

As discussed on IRC, we were calling AddTypePropertyId, but that did nothing because we were not tracking the property types.

This patch adds EnsureTrackPropertyTypes and calls it before calling AddTypePropertyId. I'm not very familiar with this code, but the patch passes jit-tests and fixes v8-earley.

Comment 2

[Brian Hackett [Laid off!]]

Comment on attachment 713932 [details] [diff] [review]
Patch

Review of attachment 713932 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jsinferinlines.h
@@ +617,5 @@
> +        AutoEnterAnalysis enter(cx);
> +
> +        TypeSet *types = obj->type()->getProperty(cx, id, true);
> +        if (!types)
> +            return false;

The boolean result here and failure checking is unnecessary and should be removed.  If getProperty() fails then TI will be disabled for the compartment,

Comment 3

[Jan de Mooij [:jandem]]

Pushed with comment addressed:

https://hg.mozilla.org/projects/ionmonkey/rev/be3a7071d301