Closed Bug 941617 Opened 8 years ago Closed 8 years ago

Backtracking allocator: Fix an Osi point clobber in ComputeThis

Categories

(Core :: JavaScript Engine: JIT, defect)

Product:
Core
Component:
JavaScript Engine: JIT
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla28

People

(Reporter: sunfish, Assigned: sunfish)

References

Details

(Whiteboard: [qa-])

Attachments

(1 file)

regalloc-osi-fixes.patch
4.57 KB, patch
bhackett1024
: review+
Details | Diff | Splinter Review 
I think I've found a better fix to bug 936891.

LIRGenerator::visitComputeThis was using useBoxAtStart for its operand, but in the case where its operand is in the same register as the call return value, registers needed for the Osi point may be clobbered, assuming I understand what's going on there. Attached is a patch which changes it to useBox to avoid this problem.

This also reverts some of the changes from bug 936891, which aren't needed anymore, and tightens up some of the shortcut conditions.
Attachment #8336048 - Flags: review?(bhackett1024)
Attachment #8336048 - Flags: review?(bhackett1024) → review+
https://hg.mozilla.org/mozilla-central/rev/9b6e729b287f
Assignee: nobody → sunfish
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla28
Whiteboard: [qa-]
You need to log in before you can comment on or make changes to this bug.