Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-15 14:25:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 703544 - Fix register allocation bug in dense array write barrier (r=bhackett)

Browse Source
This commit is contained in:
Bill McCloskey 2011-11-18 17:43:00 -08:00
parent 0cec9a62ce
commit fe2af34e51
2 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
js/src/jit-test/tests/basic/bug703544.js Normal file
View File

@ -0,0 +1,7 @@
gczeal(4);
function testInterpreterReentry7() {
var arr = [0, 1, 2, 3, 4];
for (var i = (1); i < 5; i++)
arr[i] = "grue";
}
testInterpreterReentry7();

15
js/src/methodjit/FastOps.cpp
View File

@ -1180,9 +1180,22 @@ mjit::Compiler::jsop_setelem_dense()
types::TypeSet *types = frame.extra(obj).types;
if (cx->compartment->needsBarrier() && (!types || types->propertyNeedsBarrier(cx, JSID_VOID))) {
Label barrierStart = stubcc.masm.label();
frame.sync(stubcc.masm, Uses(3));
stubcc.linkExitDirect(masm.jump(), barrierStart);
/*
* The sync call below can potentially clobber key.reg() and slotsReg.
* So we save and restore them. Additionally, the WriteBarrier stub can
* clobber both registers. The rejoin call will restore key.reg() but
* not slotsReg. So we restore it again after the stub call.
*/
stubcc.masm.storePtr(slotsReg, FrameAddress(offsetof(VMFrame, scratch)));
if (!key.isConstant())
stubcc.masm.push(key.reg());
frame.sync(stubcc.masm, Uses(3));
if (!key.isConstant())
stubcc.masm.pop(key.reg());
stubcc.masm.loadPtr(FrameAddress(offsetof(VMFrame, scratch)), slotsReg);
if (key.isConstant())
stubcc.masm.lea(Address(slotsReg, key.index() * sizeof(Value)), Registers::ArgReg1);
else