Closed Bug 880539 Opened 6 years ago Closed 6 years ago

IonMonkey: CodeGenerator::guardTypeSet doesn't handle Magic type.

Categories

(Core :: JavaScript Engine, defect)

x86
macOS
defect
Not set

Tracking

()

RESOLVED FIXED
mozilla24

People

(Reporter: djvj, Assigned: djvj)

Details

Attachments

(1 file)

As described.  TypeBarriers on typesets containing magic values do not guard for them, leading to unnecessary bailouts.
Assignee: general → kvijayan
Attached patch Fix.Splinter Review
Attachment #759590 - Flags: review?(bhackett1024)
Attachment #759590 - Flags: review?(bhackett1024) → review+
In which case a magic type is flowing in any of the register that we use in IonMonkey ?!
If this is the case then we should fix it instead of adding a guard against the Magic type.
THat's not happening.  The guard is a TypeBarrier on an incoming OSRValue in an OSR frame.  The OSRValue is a magic arguments, and the typeset says so, but the TypeBarrier ends up generating an unconditional bailout because CodeGenerator::visitTypeBarrier doesn't handle typesets which contain the MagicArg type.
https://hg.mozilla.org/mozilla-central/rev/59fc33c899c4
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla24
You need to log in before you can comment on or make changes to this bug.