Bug 1601599 part 1 - Fix assert in IonBuilder::setStaticName to account for loop phis. r=tcampbell
authorJan de Mooij <jdemooij@mozilla.com>
Sun, 15 Dec 2019 11:32:25 +0000
changeset 507021 307481f32d4403dae943b9ff26cd7a7e2eadf083
parent 507020 273abf200022ad239b277942149e6268c4fec8b2
child 507022 4903b1b93526423b2a52251081252fcfe100d8f5
push id36920
push userdluca@mozilla.com
push dateSun, 15 Dec 2019 21:49:48 +0000
treeherdermozilla-central@7e6a4e221495 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerstcampbell
bugs1601599
milestone73.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1601599 part 1 - Fix assert in IonBuilder::setStaticName to account for loop phis. r=tcampbell This is necessary once we support OSR for spread expressions. Differential Revision: https://phabricator.services.mozilla.com/D56698
js/src/jit/IonBuilder.cpp
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -8563,19 +8563,22 @@ AbortReasonOr<Ok> IonBuilder::setStaticN
   // Don't optimize global lexical bindings if they aren't initialized at
   // compile time.
   if (isGlobalLexical && IsUninitializedGlobalLexicalSlot(staticObject, name)) {
     return jsop_setprop(name);
   }
 
   current->pop();
 
-  // Pop the bound object on the stack.
+  // Pop the bound object on the stack. This is usually a constant but it can
+  // be a phi if loops are involved, for example: x = [...arr];
   MDefinition* obj = current->pop();
-  MOZ_ASSERT(&obj->toConstant()->toObject() == staticObject);
+  MOZ_ASSERT(obj->isConstant() || obj->isPhi());
+  MOZ_ASSERT_IF(obj->isConstant(),
+                &obj->toConstant()->toObject() == staticObject);
 
   if (needsPostBarrier(value)) {
     current->add(MPostWriteBarrier::New(alloc(), obj, value));
   }
 
   // If the property has a known type, we may be able to optimize typed stores
   // by not storing the type tag.
   MIRType slotType = MIRType::None;