Check if bytecode exists before accessing length in JITs
Categories
(Core :: JavaScript Engine: JIT, task, P2)
Tracking
()
Tracking | Status | |
---|---|---|
firefox73 | --- | fixed |
People
(Reporter: tcampbell, Assigned: tcampbell)
References
Details
Attachments
(5 files)
Assignee | ||
Comment 1•5 years ago
|
||
In [1,2] we access the ImmutableScriptData::funLength
field after checking for the INTERPRETED bit on function. Once this flag is removed, we'll have to handle the lazy case in another way. This can be done by checking if the BaseScript::sharedData() pointer is null before dereferencing it.
Special care must be taken in the bound function init case in Ion so that side-effects don't cause problems.
[1] https://searchfox.org/mozilla-central/rev/8d04c3f5332d470eeae5aa3dc0ed132359a339c1/js/src/jit/CacheIRCompiler.cpp#2975
[2] https://searchfox.org/mozilla-central/rev/8d04c3f5332d470eeae5aa3dc0ed132359a339c1/js/src/jit/CodeGenerator.cpp#13850
Assignee | ||
Comment 2•5 years ago
|
||
Factor out the bound-function length computation from Ion code generator.
This is to make register usage and clobbers easier to understand.
Assignee | ||
Comment 3•5 years ago
|
||
Depends on D58082
Assignee | ||
Comment 4•5 years ago
|
||
In the bound function case, we move the length initialization before the name
is set. This may result in the length being set before the guards are all
finished, but that doesn't affect the slow-path.
Depends on D58083
Assignee | ||
Comment 5•5 years ago
|
||
Depends on D58084
Assignee | ||
Comment 6•5 years ago
|
||
Use this to share the lookup code between CacheIR and Ion. Note that in the
CacheIR case we clobber the flags register, while for Ion we preserve it.
Assignee | ||
Comment 7•5 years ago
|
||
I've added another patch to do some cleanup, but will push the main patches to reduce size of lazyscript-removal stack.
Comment 9•5 years ago
|
||
bugherder |
Comment 10•5 years ago
|
||
Assignee | ||
Updated•5 years ago
|
Comment 11•5 years ago
|
||
bugherder |
Description
•