Warp: handle the unreachable-OSR-loop case
Categories
(Core :: JavaScript Engine: JIT, task, P1)
Tracking
()
| Tracking | Status | |
|---|---|---|
| firefox80 | --- | fixed |
People
(Reporter: jandem, Assigned: jandem)
References
(Blocks 1 open bug)
Details
Attachments
(5 files)
It's possible for the OSR-pc to be only reachable via a try-catch block. IonBuilder has code to handle that but WarpBuilder doesn't. I'm running into this with some local Warp patches.
|
Assignee | |
Comment 1•4 years ago
|
||
We now crash instead of silently using an offset of 0 (meaning start of the
IonScript's JIT code) for the OSR entry point if the MOsrEntry is missing
for some reason.
|
|
Assignee | |
Comment 2•4 years ago
|
||
Some changes preparing for the next patch.
Depends on D80874
|
|
Assignee | |
Comment 3•4 years ago
|
||
If we see a forward branch in a catch/finally block to a not-yet-initialized
location outside it, don't perform Ion/Warp OSR at LoopHeads following it in
the script.
The abort in IonBuilder can then be turned into an assertion. This helps
WarpBuilder because we don't want any non-OOM aborts during MIR building.
Depends on D80875
|
||
Updated•4 years ago
|
|
|
||
Updated•4 years ago
|
|
|
Assignee | |
Comment 4•4 years ago
|
||
The analysis marked code after a try-catch as always-reachable to simplify MIR
building. Now that we compute reachability of LoopHeads, there's not a lot we gain
from that complexity anymore.
We can then also remove the MGotoWithFake code and the JSOp::Try bytecode operand.
Depends on D80876
|
|
Assignee | |
Comment 5•4 years ago
|
||
The first try-catch in the test now terminates control flow after the previous patch
and we then ilooped because inIon() never returned true in the loops after that
(these loops are only reachable through the catch-block).
The patch splits the test in a few different functions to fix this.
Depends on D81029
|
||
Updated•4 years ago
|
|
||
Comment 7•4 years ago
|
||
| bugherder | ||
https://hg.mozilla.org/mozilla-central/rev/9a4078dbbe41
https://hg.mozilla.org/mozilla-central/rev/a8753560dc09
https://hg.mozilla.org/mozilla-central/rev/c3121ce23d2c
https://hg.mozilla.org/mozilla-central/rev/dfce0fc62953
https://hg.mozilla.org/mozilla-central/rev/5bd462d99f91
Description
•