928776 - Create template call and decl env objects in baseline

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Brian Hackett [Laid off!]]

As with the template objects addressed in bug 922270, these are templates which IonBuilder depends on.

Comment 1

[Brian Hackett [Laid off!]]

Attachment: patch

Comment 2

[Jan de Mooij [:jandem]]

Comment on attachment 819526 [details] [diff] [review]
patch

Review of attachment 819526 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit/IonBuilder.cpp
@@ -4507,5 @@
> -
> -    // Add dummy values on the slot of the template object such as we do not try
> -    // mark uninitialized values.
> -    templateObj->setFixedSlot(DeclEnvObject::enclosingScopeSlot(), MagicValue(JS_GENERIC_MAGIC));
> -    templateObj->setFixedSlot(DeclEnvObject::lambdaSlot(), MagicValue(JS_GENERIC_MAGIC));

Was this bogus or do we still want this in BaselineCompiler.cpp?

Comment 3

[Brian Hackett [Laid off!]]

(In reply to Jan de Mooij [:jandem] from comment #2)
> Comment on attachment 819526 [details] [diff] [review]
> patch
> 
> Review of attachment 819526 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> ::: js/src/jit/IonBuilder.cpp
> @@ -4507,5 @@
> > -
> > -    // Add dummy values on the slot of the template object such as we do not try
> > -    // mark uninitialized values.
> > -    templateObj->setFixedSlot(DeclEnvObject::enclosingScopeSlot(), MagicValue(JS_GENERIC_MAGIC));
> > -    templateObj->setFixedSlot(DeclEnvObject::lambdaSlot(), MagicValue(JS_GENERIC_MAGIC));
> 
> Was this bogus or do we still want this in BaselineCompiler.cpp?

These calls are bogus, after allocating an object its slots are immediately initialized up to its slot span.  See JSObject::updateSlotsForSpan, otherwise we would have all sorts of hazards when allocating objects.

Comment 4

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f6801c7e6500

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/f6801c7e6500