Closed Bug 898576 Opened 6 years ago Closed 6 years ago

IonMonkey: Ignore inputs with empty type sets when specializing phis

Categories

(Core :: JavaScript Engine, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla25

People

(Reporter: shu, Assigned: shu)

References

Details

Attachments

(1 file)

We already ignore inputs with empty type sets inside IonBuilder, but we don't do this when applying type information. This causes some unfortunate code to be generated; take this snippet:

var foo;
if (cond)
  foo = 0;
else
  foo = SomeNeverExecutedFunction();
print("" + foo);

Assuming cond is always true, during IonBuilder, the phi for foo is Int32 because we never run the other branch. We generate an MConcat for the +. After applying type info, the phi is now MIRType_Value, and we inserted an MBox for foo = 0. MConcat's type policy then generates an MUnbox (to String! lol) for foo, and we always bail out during execution.
Attached patch v0Splinter Review
Assignee: general → shu
Attachment #781868 - Flags: review?(jdemooij)
Attachment #781868 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/471dcc138dfe
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla25
You need to log in before you can comment on or make changes to this bug.