930057 - Incorrect return false in TypedObject JIT compilation

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Niko Matsakis [:nmatsakis]]

IonBuilder::lookupTypedObjectField() incorrectly returns false at one point even though no fatal error has occurred. Correct thing is to return true but yield an empty resulting TypeRepresentationSet.

Comment 1

[Niko Matsakis [:nmatsakis]]

Attachment: Bug930057.diff

Comment 2

[Jan de Mooij [:jandem]]

Comment on attachment 821123 [details] [diff] [review]
Bug930057.diff

Review of attachment 821123 [details] [diff] [review]:
-----------------------------------------------------------------

Do you happen to have a testcase we can add maybe?

Comment 3

[Niko Matsakis [:nmatsakis]]

jandem: I can try to come up with one.

Comment 4

[Niko Matsakis [:nmatsakis]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/506e95c64fb4

Try run: https://tbpl.mozilla.org/?tree=Try&rev=ad8fccfc779f

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/506e95c64fb4