Bug 1429031 - Fix an assertion failure while optimising a module namespace access r=jandem
authorJon Coppeard <jcoppeard@mozilla.com>
Wed, 10 Jan 2018 18:24:34 +0000
changeset 452943 d055b4f81d592ee54a6593d09d928c28901b689d
parent 452942 5d31366297e700d20dccb3e73671a1951b0b952f
child 452944 1e1991807b395b83e2e1e7b1eb67ce00c479da2e
push id1648
push usermtabara@mozilla.com
push dateThu, 01 Mar 2018 12:45:47 +0000
treeherdermozilla-release@cbb9688c2eeb [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1429031
milestone59.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1429031 - Fix an assertion failure while optimising a module namespace access r=jandem
js/src/jit-test/tests/modules/bug1429031.js
js/src/jit/IonBuilder.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/modules/bug1429031.js
@@ -0,0 +1,20 @@
+// |jit-test| error: ReferenceError
+
+let moduleRepo = {};
+setModuleResolveHook(function(module, specifier) {
+    return moduleRepo[specifier];
+});
+assertEq = function(a, b) {}
+evaluate(`
+let a = moduleRepo['a'] = parseModule(
+    'export var a = 1;'
+);
+let b = moduleRepo['b'] = parseModule(
+    \`import * as ns from 'a';
+     export var x = ns.a + ns.b;\`
+);
+b.declarationInstantiation();
+let ns = getModuleEnvironmentValue(b, "ns");
+assertEq(ns.a, 1);
+while ( t.ArrayType() ) 1;
+`);
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -10837,17 +10837,22 @@ IonBuilder::getPropTryModuleNamespace(bo
         trackOptimizationOutcome(TrackedOutcome::UnknownProperty);
         return Ok();
     }
 
     obj->setImplicitlyUsedUnchecked();
     MConstant* envConst = constant(ObjectValue(*env));
     uint32_t slot = shape->slot();
     uint32_t nfixed = env->numFixedSlots();
-    MOZ_TRY(loadSlot(envConst, slot, nfixed, types->getKnownMIRType(), barrier, types));
+
+    MIRType rvalType = types->getKnownMIRType();
+    if (barrier != BarrierKind::NoBarrier || IsNullOrUndefined(rvalType))
+        rvalType = MIRType::Value;
+
+    MOZ_TRY(loadSlot(envConst, slot, nfixed, rvalType, barrier, types));
 
     trackOptimizationSuccess();
     *emitted = true;
     return Ok();
 }
 
 MInstruction*
 IonBuilder::loadUnboxedProperty(MDefinition* obj, size_t offset, JSValueType unboxedType,