Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-12-04 02:57:38 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1702465: Limit hoisting of arguments bounds checks r=jandem

Browse Source 
Differential Revision: https://phabricator.services.mozilla.com/D110644
This commit is contained in:
Iain Ireland 2021-04-06 18:47:02 +00:00
parent dbc8fb71dc
commit f2f47b4cfe
2 changed files with 22 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
js/src/jit-test/tests/warp/bug1702465.js Normal file
View File

@ -0,0 +1,14 @@
function foo() {
if (arguments[0]) {
return arguments[1];
}
}
with ({}) {}
for (var i = 0; i < 100; i++) {
foo(true, 1);
}
for (var i = 0; i < 100; i++) {
foo(false);
}

11
js/src/jit/ScalarReplacement.cpp
View File

@ -1629,8 +1629,6 @@ void ArgumentsReplacer::visitLoadArgumentsObjectArg(
if (isInlinedArguments()) {
auto* actualArgs = args_->toCreateInlinedArgumentsObject();
// TODO: optimize for constant indices.
// Insert bounds check.
auto* length =
MConstant::New(alloc(), Int32Value(actualArgs->numActuals()));
@ -1640,6 +1638,10 @@ void ArgumentsReplacer::visitLoadArgumentsObjectArg(
check->setBailoutKind(ins->bailoutKind());
ins->block()->insertBefore(ins, check);
if (mir_->outerInfo().hadBoundsCheckBailout()) {
check->setNotMovable();
}
loadArg = MGetInlinedArgument::New(alloc(), check, actualArgs);
} else {
// Insert bounds check.
@ -1647,9 +1649,12 @@ void ArgumentsReplacer::visitLoadArgumentsObjectArg(
ins->block()->insertBefore(ins, length);
MInstruction* check = MBoundsCheck::New(alloc(), index, length);
check->setBailoutKind(ins->bailoutKind());
ins->block()->insertBefore(ins, check);
check->setBailoutKind(ins->bailoutKind());
if (mir_->outerInfo().hadBoundsCheckBailout()) {
check->setNotMovable();
}
if (JitOptions.spectreIndexMasking) {
check = MSpectreMaskIndex::New(alloc(), check, length);