898576 - IonMonkey: Ignore inputs with empty type sets when specializing phis

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Shu-yu Guo [:shu]]

We already ignore inputs with empty type sets inside IonBuilder, but we don't do this when applying type information. This causes some unfortunate code to be generated; take this snippet:

var foo;
if (cond)
  foo = 0;
else
  foo = SomeNeverExecutedFunction();
print("" + foo);

Assuming cond is always true, during IonBuilder, the phi for foo is Int32 because we never run the other branch. We generate an MConcat for the +. After applying type info, the phi is now MIRType_Value, and we inserted an MBox for foo = 0. MConcat's type policy then generates an MUnbox (to String! lol) for foo, and we always bail out during execution.

Comment 1

[Shu-yu Guo [:shu]]

Attachment: v0

Comment 2

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/471dcc138dfe