Closed Bug 928776 Opened 6 years ago Closed 6 years ago

Create template call and decl env objects in baseline

Categories

(Core :: JavaScript Engine: JIT, defect)

x86
macOS
defect
Not set

Tracking

()

RESOLVED FIXED
mozilla27

People

(Reporter: bhackett, Assigned: bhackett)

References

Details

Attachments

(1 file)

As with the template objects addressed in bug 922270, these are templates which IonBuilder depends on.
Attached patch patchSplinter Review
Assignee: nobody → bhackett1024
Attachment #819526 - Flags: review?(jdemooij)
Comment on attachment 819526 [details] [diff] [review]
patch

Review of attachment 819526 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jit/IonBuilder.cpp
@@ -4507,5 @@
> -
> -    // Add dummy values on the slot of the template object such as we do not try
> -    // mark uninitialized values.
> -    templateObj->setFixedSlot(DeclEnvObject::enclosingScopeSlot(), MagicValue(JS_GENERIC_MAGIC));
> -    templateObj->setFixedSlot(DeclEnvObject::lambdaSlot(), MagicValue(JS_GENERIC_MAGIC));

Was this bogus or do we still want this in BaselineCompiler.cpp?
Attachment #819526 - Flags: review?(jdemooij) → review+
(In reply to Jan de Mooij [:jandem] from comment #2)
> Comment on attachment 819526 [details] [diff] [review]
> patch
> 
> Review of attachment 819526 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> ::: js/src/jit/IonBuilder.cpp
> @@ -4507,5 @@
> > -
> > -    // Add dummy values on the slot of the template object such as we do not try
> > -    // mark uninitialized values.
> > -    templateObj->setFixedSlot(DeclEnvObject::enclosingScopeSlot(), MagicValue(JS_GENERIC_MAGIC));
> > -    templateObj->setFixedSlot(DeclEnvObject::lambdaSlot(), MagicValue(JS_GENERIC_MAGIC));
> 
> Was this bogus or do we still want this in BaselineCompiler.cpp?

These calls are bogus, after allocating an object its slots are immediately initialized up to its slot span.  See JSObject::updateSlotsForSpan, otherwise we would have all sorts of hazards when allocating objects.
https://hg.mozilla.org/mozilla-central/rev/f6801c7e6500
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla27
You need to log in before you can comment on or make changes to this bug.