IonMonkey: Ignore inputs with empty type sets when specializing phis

RESOLVED FIXED in mozilla25

Status

()

RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: shu, Assigned: shu)

Tracking

unspecified
mozilla25
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

5 years ago
We already ignore inputs with empty type sets inside IonBuilder, but we don't do this when applying type information. This causes some unfortunate code to be generated; take this snippet:

var foo;
if (cond)
  foo = 0;
else
  foo = SomeNeverExecutedFunction();
print("" + foo);

Assuming cond is always true, during IonBuilder, the phi for foo is Int32 because we never run the other branch. We generate an MConcat for the +. After applying type info, the phi is now MIRType_Value, and we inserted an MBox for foo = 0. MConcat's type policy then generates an MUnbox (to String! lol) for foo, and we always bail out during execution.
(Assignee)

Comment 1

5 years ago
Created attachment 781868 [details] [diff] [review]
v0
Assignee: general → shu
Attachment #781868 - Flags: review?(jdemooij)

Updated

5 years ago
Attachment #781868 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/471dcc138dfe
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla25
Depends on: 905986
You need to log in before you can comment on or make changes to this bug.