874825 - IonMonkey: HAS_ARGS_OBJ flag lost when bailing out to baseline

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

Attachment: Patch

Uncovered by the patch in bug 868431. The problem is that initArgsObjUnchecked sets the HAS_ARGS_OBJ flag on the frame, so we should call it after we call setFlags.

Filing as separate bug so that we can track it for Firefox 23.

Comment 1

[Jan de Mooij [:jandem]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/a4fd7b182bc2

(Try: https://tbpl.mozilla.org/?tree=Try&rev=4bab52e636eb)

Comment 2

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/a4fd7b182bc2

Comment 3

[Jan de Mooij [:jandem]]

Comment on attachment 752655 [details] [diff] [review]
Patch

[Approval Request Comment]
Bug caused by (feature/regressing bug #): Bug 860145
User impact if declined: Correctness bugs.
Testing completed (on m-c, etc.): On m-c for a few days.
Risk to taking this patch (and alternatives if risky): Very low.
String or IDL/UUID changes made by this patch: None.

Comment 4

[Lukas Blakk [:lsblakk] use ?needinfo]

untracking since it looks like this is about correctness and not user impact or stability.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/0eda38ccaef7