Bug 1148970 - Check for possibly incomplete type sets when double checking the correctness of argument type set information, r=jandem.
authorBrian Hackett <bhackett1024@gmail.com>
Thu, 09 Apr 2015 10:29:53 -0600
changeset 257312 8cdd47cc88a626669d6d4b060aeaf12b73b00f76
parent 257311 07839dbde05cebef84f067640015d7c055ddb6c4
child 257313 678f89d62b399b62035bbf0cf6d477cf9126d205
push id8007
push userraliiev@mozilla.com
push dateMon, 11 May 2015 19:23:16 +0000
treeherdermozilla-aurora@e2ce1aac996e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1148970
milestone40.0a1
Bug 1148970 - Check for possibly incomplete type sets when double checking the correctness of argument type set information, r=jandem.
js/src/jit/CodeGenerator.cpp
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -3530,16 +3530,28 @@ CodeGenerator::generateArgumentsChecks(b
 
     if (miss.used()) {
         if (bailout) {
             bailoutFrom(&miss, graph.entrySnapshot());
         } else {
             Label success;
             masm.jump(&success);
             masm.bind(&miss);
+
+            // Check for cases where the type set guard might have missed due to
+            // changing object groups.
+            for (uint32_t i = info.startArgSlot(); i < info.endArgSlot(); i++) {
+                Label skip;
+                Address addr(StackPointer, ArgToStackOffset((i - info.startArgSlot()) * sizeof(Value)));
+                masm.branchTestObject(Assembler::NotEqual, addr, &skip);
+                Register obj = masm.extractObject(addr, temp);
+                masm.guardTypeSetMightBeIncomplete(obj, temp, &success);
+                masm.bind(&skip);
+            }
+
             masm.assumeUnreachable("Argument check fail.");
             masm.bind(&success);
         }
     }
 }
 
 // Out-of-line path to report over-recursed error and fail.
 class CheckOverRecursedFailure : public OutOfLineCodeBase<CodeGenerator>