wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-09 09:18:42 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #1624 - Fix slot access intrinsics for objects with > 16 reserved slots

Browse source 
Also flips ion inlining pref back on
This commit is contained in:
Matt A. Tobin 2021-01-11 09:31:44 -05:00 • committed by roytam1
commit 325e57e916
2 changed files with 9 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
js/src/jit/MCallOptimize.cpp
View file

@ -2618,6 +2618,10 @@ IonBuilder::inlineUnsafeSetReservedSlot(CallInfo& callInfo)
return InliningStatus_NotInlined;
uint32_t slot = uint32_t(arg->toConstant()->toInt32());
// Don't inline if it's not a fixed slot.
if (slot >= NativeObject::MAX_FIXED_SLOTS)
return InliningStatus_NotInlined;
callInfo.setImplicitlyUsedUnchecked();
MStoreFixedSlot* store =
@ -2649,6 +2653,10 @@ IonBuilder::inlineUnsafeGetReservedSlot(CallInfo& callInfo, MIRType knownValueTy
return InliningStatus_NotInlined;
uint32_t slot = uint32_t(arg->toConstant()->toInt32());
// Don't inline if it's not a fixed slot.
if (slot >= NativeObject::MAX_FIXED_SLOTS)
return InliningStatus_NotInlined;
callInfo.setImplicitlyUsedUnchecked();
MLoadFixedSlot* load = MLoadFixedSlot::New(alloc(), callInfo.getArg(0), slot);

2
modules/libpref/init/all.js
View file

@ -1272,7 +1272,7 @@ pref("javascript.options.strict.debug", false);
pref("javascript.options.unboxed_objects", false);
pref("javascript.options.baselinejit", true);
pref("javascript.options.ion", true);
pref("javascript.options.ion.inlining", false);
pref("javascript.options.ion.inlining", true);
pref("javascript.options.asmjs", true);
pref("javascript.options.wasm", true);
// wasm jit crashes in 32bit builds because of 64bit casts so