943989 - Incorrect generation guard done in GenerateDOMProxyChecks in the baseline compiler

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Boris Zbarsky [:bzbarsky]]

masm.branch32(Assembler::NotEqual,
                      Address(tempVal.scratchReg(), offsetof(ExpandoAndGeneration, expando)),
                      scratch, &failDOMProxyCheck);


Note the offsetof call.  Should be "generation", not "expando".

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Check the right member for our generation, and replace some hardcoded offsets with offsetof values.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: Let's have it actually compile

Comment 3

[Eric Faust [:efaust]]

Comment on attachment 8339481 [details] [diff] [review]
Let's have it actually compile

Review of attachment 8339481 [details] [diff] [review]:
-----------------------------------------------------------------

There is standing precedent to do this as ExpandoAndGeneration::offsetOf{Expando,Generation} and let them be inlined.

r=me. Thanks for the cleanup.

Comment 4

[Boris Zbarsky [:bzbarsky]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/04ab309c684a with that change to static methods.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/04ab309c684a