Bug 1174322 - RObjectState::recover: Work-around the lack of MStoreUnboxedBoolean. r=bhackett
authorNicolas B. Pierron <nicolas.b.pierron@mozilla.com>
Wed, 17 Jun 2015 14:03:04 +0200
changeset 280112 f9c16fa4852ccea8fb87b10626309a055d73c2cd
parent 280111 a57875030d605c5f9bffc1e048738f5cbdcc366f
child 280113 1cb820f427d87b46b34519c17652e84205f369f1
push id4932
push userjlund@mozilla.com
push dateMon, 10 Aug 2015 18:23:06 +0000
treeherdermozilla-beta@6dd5a4f5f745 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbhackett
bugs1174322
milestone41.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1174322 - RObjectState::recover: Work-around the lack of MStoreUnboxedBoolean. r=bhackett
js/src/jit-test/tests/ion/recover-object-bug1174322.js
js/src/jit/Recover.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/ion/recover-object-bug1174322.js
@@ -0,0 +1,13 @@
+function f(y) {
+    Math.min(NaN) ? a : y
+}
+function g(y) {
+    f({
+        e: false
+    })
+}
+x = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+     0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
+for (var j = 0; j < 23; ++j) {
+    g(x[j])
+}
--- a/js/src/jit/Recover.cpp
+++ b/js/src/jit/Recover.cpp
@@ -1373,21 +1373,30 @@ RObjectState::recover(JSContext* cx, Sna
     RootedValue val(cx);
 
     if (object->is<UnboxedPlainObject>()) {
         const UnboxedLayout& layout = object->as<UnboxedPlainObject>().layout();
 
         const UnboxedLayout::PropertyVector& properties = layout.properties();
         for (size_t i = 0; i < properties.length(); i++) {
             val = iter.read();
+
             // This is the default placeholder value of MObjectState, when no
             // properties are defined yet.
             if (val.isUndefined())
                 continue;
 
+            // In order to simplify the code, we do not have a
+            // MStoreUnboxedBoolean, but we reuse the MStoreUnboxedScalar code.
+            // This has a nasty side-effect of add a MTruncate which coerce the
+            // boolean into an Int32. The following code check that if the
+            // property was expected to be a boolean, then we coerce it here.
+            if (properties[i].type == JSVAL_TYPE_BOOLEAN)
+                val.setBoolean(val.toInt32() != 0);
+
             MOZ_ALWAYS_TRUE(object->as<UnboxedPlainObject>().setValue(cx, properties[i], val));
         }
     } else {
         RootedNativeObject nativeObject(cx, &object->as<NativeObject>());
         MOZ_ASSERT(nativeObject->slotSpan() == numSlots());
 
         for (size_t i = 0; i < numSlots(); i++) {
             val = iter.read();