Closed Bug 880539 Opened 6 years ago Closed 6 years ago
Monkey: Code Generator::guard Type Set doesn't handle Magic type .
As described. TypeBarriers on typesets containing magic values do not guard for them, leading to unnecessary bailouts.
Attachment #759590 - Flags: review?(bhackett1024) → review+
In which case a magic type is flowing in any of the register that we use in IonMonkey ?! If this is the case then we should fix it instead of adding a guard against the Magic type.
THat's not happening. The guard is a TypeBarrier on an incoming OSRValue in an OSR frame. The OSRValue is a magic arguments, and the typeset says so, but the TypeBarrier ends up generating an unconditional bailout because CodeGenerator::visitTypeBarrier doesn't handle typesets which contain the MagicArg type.
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla24
You need to log in before you can comment on or make changes to this bug.