Closed Bug 930991 Opened 6 years ago Closed 6 years ago

IonMonkey: Fix over restrictive bailout with TypeSets that contain a combination of SingleObjects and TypedObjects

Categories

(Core :: JavaScript Engine: JIT, defect)

defect
Not set

Tracking

()

RESOLVED FIXED
mozilla27

People

(Reporter: h4writer, Assigned: h4writer)

References

Details

Attachments

(1 file)

The last SingleObject we see in an argumentscheck doesn't get checked properly if there is a typedObject following. Since we now do delayed branch, the register can change of value, before we are emitting the branch. As a result this check will always fail.

This can cause extra bailouts.
Blocks: 930989
The refactoring was reviewed by nbp. Taking Jan now, since I want to land today, together with depending bug.
Assignee: nobody → hv1989
Attachment #822294 - Flags: review?(jdemooij)
Attachment #822294 - Attachment is patch: true
Comment on attachment 822294 [details] [diff] [review]
bug930991-remove-arg-bail

Review of attachment 822294 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch.
Attachment #822294 - Flags: review?(jdemooij) → review+
https://hg.mozilla.org/mozilla-central/rev/14fa49fdadfe
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla27
You need to log in before you can comment on or make changes to this bug.