From 325e57e916985c3f57e30c48ec26629aa94c797b Mon Sep 17 00:00:00 2001 From: "Matt A. Tobin" Date: Mon, 11 Jan 2021 09:31:44 -0500 Subject: [PATCH] Issue #1624 - Fix slot access intrinsics for objects with > 16 reserved slots Also flips ion inlining pref back on --- js/src/jit/MCallOptimize.cpp | 8 ++++++++ modules/libpref/init/all.js | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp index 0033e40b9c..182fa2fd5a 100644 --- a/js/src/jit/MCallOptimize.cpp +++ b/js/src/jit/MCallOptimize.cpp @@ -2618,6 +2618,10 @@ IonBuilder::inlineUnsafeSetReservedSlot(CallInfo& callInfo) return InliningStatus_NotInlined; uint32_t slot = uint32_t(arg->toConstant()->toInt32()); + // Don't inline if it's not a fixed slot. + if (slot >= NativeObject::MAX_FIXED_SLOTS) + return InliningStatus_NotInlined; + callInfo.setImplicitlyUsedUnchecked(); MStoreFixedSlot* store = @@ -2649,6 +2653,10 @@ IonBuilder::inlineUnsafeGetReservedSlot(CallInfo& callInfo, MIRType knownValueTy return InliningStatus_NotInlined; uint32_t slot = uint32_t(arg->toConstant()->toInt32()); + // Don't inline if it's not a fixed slot. + if (slot >= NativeObject::MAX_FIXED_SLOTS) + return InliningStatus_NotInlined; + callInfo.setImplicitlyUsedUnchecked(); MLoadFixedSlot* load = MLoadFixedSlot::New(alloc(), callInfo.getArg(0), slot); diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js index 94201fae8a..6d3bac2869 100644 --- a/modules/libpref/init/all.js +++ b/modules/libpref/init/all.js @@ -1272,7 +1272,7 @@ pref("javascript.options.strict.debug", false); pref("javascript.options.unboxed_objects", false); pref("javascript.options.baselinejit", true); pref("javascript.options.ion", true); -pref("javascript.options.ion.inlining", false); +pref("javascript.options.ion.inlining", true); pref("javascript.options.asmjs", true); pref("javascript.options.wasm", true); // wasm jit crashes in 32bit builds because of 64bit casts so