Can't use lr->from. Seems to not get set in certain cases. Go figure. The nanojit tree code is really weird.
authorAndreas Gal <gal@mozilla.com>
Fri, 25 Jul 2008 02:29:36 -0700
changeset 17826 75805867814e6e819ba7508a20ffd01dc126b55e
parent 17825 f5149a2b93091409dc28978c5c29cd00460188d3
child 17827 fd9cf3c556ee0d410dc934be71956a0d33271d2c
push id1452
push usershaver@mozilla.com
push dateFri, 22 Aug 2008 00:08:22 +0000
treeherderautoland@d13bb0868596 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone1.9.1a1pre
Can't use lr->from. Seems to not get set in certain cases. Go figure. The nanojit tree code is really weird.
js/src/jstracer.cpp
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -1277,34 +1277,34 @@ js_ExecuteTree(JSContext* cx, Fragment* 
     JS_ASSERT(*(uint64*)&global[ti->ngslots] == 0xdeadbeefdeadbeefLL);
 
     AUDIT(sideExitIntoInterpreter);
     
     return lr;
 }
 
 static bool
-js_AttemptToExtendTree(JSContext* cx, GuardRecord* lr)
+js_AttemptToExtendTree(JSContext* cx, GuardRecord* lr, Fragment* f)
 {
     debug_only(printf("trying to attach another branch to the tree\n");)
 
     Fragment* c;
     if (!(c = lr->target)) {
         c = JS_TRACE_MONITOR(cx).fragmento->createBranch(lr, lr->exit);
         c->spawnedFrom = lr->guard;
-        c->parent = lr->from;
+        c->parent = f;
         lr->exit->target = c;
         lr->target = c;
-        c->root = c->parent;
+        c->root = f;
         c->calldepth = lr->calldepth;
     }
 
     if (++c->hits() >= HOTEXIT) {
         /* start tracing secondary trace from this point */
-        c->lirbuf = c->parent->lirbuf;
+        c->lirbuf = f->lirbuf;
         return js_StartRecorder(cx, lr, c, lr->guard->exit()->typeMap);
     }
     return false;
 }
 
 bool
 js_LoopEdge(JSContext* cx, jsbytecode* oldpc)
 {
@@ -1397,17 +1397,17 @@ js_LoopEdge(JSContext* cx, jsbytecode* o
     
     if (!lr) /* did the tree actually execute? */
         return false;
     
     /* if the side exit terminates the loop, don't try to attach a trace here */
     if (lr->exit->loopExit)
         return false;
 
-    return js_AttemptToExtendTree(cx, lr);
+    return js_AttemptToExtendTree(cx, lr, f);
 }
 
 void
 js_AbortRecording(JSContext* cx, jsbytecode* abortpc, const char* reason)
 {
     AUDIT(recorderAborted);
     debug_only(if (!abortpc) abortpc = cx->fp->regs->pc;
                printf("Abort recording (line %d, pc %d): %s.\n",