Bug 1138693 - Add comments and test. r=jandem
authorNicolas B. Pierron <nicolas.b.pierron@mozilla.com>
Fri, 17 Jul 2015 19:38:57 +0200
changeset 253522 cd1d4134f29c1b26f5c7f542a66d35247a2f934e
parent 253521 5b4a4d8e5a801ba292c589d0d47c4b30971b8448
child 253523 154a12a7a91c2f0e6ce00500ca25883923e9bccd
push id29067
push userkwierso@gmail.com
push dateSat, 18 Jul 2015 00:57:04 +0000
treeherdermozilla-central@e2f2eb9ecca0 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1138693
milestone42.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1138693 - Add comments and test. r=jandem
js/src/jit-test/tests/ion/scalar-replacement-bug1138693.js
js/src/jit/ScalarReplacement.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/scalar-replacement-bug1138693.js
@@ -0,0 +1,19 @@
+var T = TypedObject;
+var ST = new T.StructType({x:T.int32});
+function check(v) {
+    return v.toSource();
+}
+function test() {
+    var fake = { toSource: ST.toSource };
+    try {
+        check(fake);
+    } catch (e) {}
+}
+test();
+var uint8 = TypedObject.uint8;
+function runTests() {
+  uint8.toSource();
+}
+runTests();
+test();
+
--- a/js/src/jit/ScalarReplacement.cpp
+++ b/js/src/jit/ScalarReplacement.cpp
@@ -486,16 +486,18 @@ ObjectMemoryView::visitStoreFixedSlot(MS
         return;
 
     // Clone the state and update the slot value.
     if (state_->hasFixedSlot(ins->slot())) {
         state_ = BlockState::Copy(alloc_, state_);
         state_->setFixedSlot(ins->slot(), ins->value());
         ins->block()->insertBefore(ins->toInstruction(), state_);
     } else {
+        // UnsafeSetReserveSlot can access baked-in slots which are guarded by
+        // conditions, which are not seen by the escape analysis.
         MBail* bailout = MBail::New(alloc_, Bailout_Inevitable);
         ins->block()->insertBefore(ins, bailout);
     }
 
     // Remove original instruction.
     ins->block()->discard(ins);
 }
 
@@ -505,16 +507,18 @@ ObjectMemoryView::visitLoadFixedSlot(MLo
     // Skip loads made on other objects.
     if (ins->object() != obj_)
         return;
 
     // Replace load by the slot value.
     if (state_->hasFixedSlot(ins->slot())) {
         ins->replaceAllUsesWith(state_->getFixedSlot(ins->slot()));
     } else {
+        // UnsafeGetReserveSlot can access baked-in slots which are guarded by
+        // conditions, which are not seen by the escape analysis.
         MBail* bailout = MBail::New(alloc_, Bailout_Inevitable);
         ins->block()->insertBefore(ins, bailout);
         ins->replaceAllUsesWith(undefinedVal_);
     }
 
     // Remove original instruction.
     ins->block()->discard(ins);
 }
@@ -542,16 +546,18 @@ ObjectMemoryView::visitStoreSlot(MStoreS
     }
 
     // Clone the state and update the slot value.
     if (state_->hasDynamicSlot(ins->slot())) {
         state_ = BlockState::Copy(alloc_, state_);
         state_->setDynamicSlot(ins->slot(), ins->value());
         ins->block()->insertBefore(ins->toInstruction(), state_);
     } else {
+        // UnsafeSetReserveSlot can access baked-in slots which are guarded by
+        // conditions, which are not seen by the escape analysis.
         MBail* bailout = MBail::New(alloc_, Bailout_Inevitable);
         ins->block()->insertBefore(ins, bailout);
     }
 
     // Remove original instruction.
     ins->block()->discard(ins);
 }
 
@@ -565,16 +571,18 @@ ObjectMemoryView::visitLoadSlot(MLoadSlo
         MOZ_ASSERT(!slots->object()->isGuardShape() || slots->object()->toGuardShape()->obj() != obj_);
         return;
     }
 
     // Replace load by the slot value.
     if (state_->hasDynamicSlot(ins->slot())) {
         ins->replaceAllUsesWith(state_->getDynamicSlot(ins->slot()));
     } else {
+        // UnsafeGetReserveSlot can access baked-in slots which are guarded by
+        // conditions, which are not seen by the escape analysis.
         MBail* bailout = MBail::New(alloc_, Bailout_Inevitable);
         ins->block()->insertBefore(ins, bailout);
         ins->replaceAllUsesWith(undefinedVal_);
     }
 
     // Remove original instruction.
     ins->block()->discard(ins);
 }