According to the comment above MCreateThis, this opcode should return MagicValue(JS_IS_CONSTRUCTING) for native functions. This isn't the case! There is no code in codegenerator for doing that! So I've update MCreateThis to add this (this was the source why nightly crashed the 29th of November, because I depended on it) While I was at it, I adjusted more things: - Split CreateThis into CreateThis and CreateThisWithTemplate -- CreateThis: --- always uses the VMCall and needs Callee and Prototype. --- return type is MIRType_Value (in order to return MagicValue) --- gets optimized to MIRType_Object, when we are sure it doesn't need NativeCheck -- CreateThisWithTemplate is our fastpath and only needs a templateObject --- Don't need Callee and Prototype! Old code depended on both

Small fault in my code. defineBox isn't allowed for CallIncstructions

FYI I'll push this testcase too: function TestCase(n, d, e, a) {} function reportCompare () { var testcase = new TestCase(); } reportCompare(); schedulegc(10); this.TestCase=Number; reportCompare(4294967295.5);

Comment on attachment 689683 [details] [diff] [review] Add handling of MagicValue(JS_IS_CONSTRUCTING) to MCreateThis Review of attachment 689683 [details] [diff] [review]: ----------------------------------------------------------------- ::: js/src/ion/IonBuilder.cpp @@ +3613,5 @@ > return createThis; > } > + > + MDefinition *createThis = createThisScripted(callee); > + createThis->toCreateThis()->removeNativeCheck(); MCreateThis *createThis = ... (if that assignment isn't valid, the toCreateThis could fail?) ::: js/src/ion/IonMacroAssembler.h @@ +284,5 @@ > Address address(fun, offsetof(JSFunction, nargs)); > uint32_t bit = JSFunction::INTERPRETED << 16; > branchTest32(Assembler::Zero, address, Imm32(bit), label); > } > + void branchIfFunctionHasScript(Register fun, Label *label) { nit: rename to "branchIfInterpreted" or something, since that's what you're really testing here. We might have lazy script generation at some point.

I had to add an extra line to handle JSObject* to js::Value return. https://hg.mozilla.org/integration/mozilla-inbound/rev/f1a9592618ec

This is build on top of previous patch and just splits the lowering part into Value and Object version, to make sure the right amount of defines are given in the 32bit case