Bug 1368576 - Fix addOsrValueTypeBarrier to use type from the TypeSet if it's more precise. r=nbp
authorJan de Mooij <jdemooij@mozilla.com>
Tue, 06 Jun 2017 15:05:08 +0200
changeset 410691 9c6ee0bd191b7ff7195870b0674d4574b2851b9f
parent 410690 fd90d75e1b5111ca178efea29c7e1af7d1bdee4e
child 410692 ee3c032059e517cf3d25b80c835dc45e2711b504
push id7391
push usermtabara@mozilla.com
push dateMon, 12 Jun 2017 13:08:53 +0000
treeherdermozilla-beta@2191d7f87e2e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnbp
bugs1368576
milestone55.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1368576 - Fix addOsrValueTypeBarrier to use type from the TypeSet if it's more precise. r=nbp
js/src/jit/IonBuilder.cpp
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -1211,16 +1211,21 @@ IonBuilder::addOsrValueTypeBarrier(uint3
     def->setResultType(MIRType::Value);
     def->setResultTypeSet(nullptr);
 
     if (typeSet && !typeSet->unknown()) {
         MInstruction* barrier = MTypeBarrier::New(alloc(), def, typeSet);
         osrBlock->insertBefore(osrBlock->lastIns(), barrier);
         osrBlock->rewriteSlot(slot, barrier);
         def = barrier;
+
+        // If the TypeSet is more precise than |type|, adjust |type| for the
+        // code below.
+        if (type == MIRType::Value)
+            type = barrier->type();
     } else if (type == MIRType::Null ||
                type == MIRType::Undefined ||
                type == MIRType::MagicOptimizedArguments)
     {
         // No unbox instruction will be added below, so check the type by
         // adding a type barrier for a singleton type set.
         TypeSet::Type ntype = TypeSet::PrimitiveType(ValueTypeFromMIRType(type));
         LifoAlloc* lifoAlloc = alloc().lifoAlloc();