Right now xpcshell tests run with -m -n (JM+TI). We should switch this to BC+Ion+TI to get some extra testing.

So, funny thing is that -n to enable TI is broken in xpcshell. xpcshell.cpp does the following: nsCOMPtr<nsIJSRuntimeService> rtsvc = do_GetService("@mozilla.org/js/xpc/RuntimeService;1"); // get the JSRuntime from the runtime svc ...snip... cx = JS_NewContext(rt, 8192); ...snip... ProcessArgsForCompartment(cx, argv, argc); ProcessArgsForCompartment parses the TI, JIT flags etc. The problem is that JSOPTION_TYPE_INFERENCE has to be set on the cx when we create the Zone/Compartment, or TI will be disabled even if we set the flag later. What happens is that the do_GetService call somehow creates a new JSContext and a new Zone, so when we set the flags we are too late. I'm not sure how to fix this, we need the JSRuntime before we can create the JSContext... Trace in case it helps: frame #0: 0x0000000103f85e84 XUL`js::types::TypeZone::init frame #1: 0x000000010440a55f XUL`JS::Zone::init frame #2: 0x0000000103f48cfc XUL`js::NewCompartment frame #3: 0x0000000103e385b6 XUL`JS_NewGlobalObject frame #4: 0x0000000101babc62 XUL`xpc::CreateGlobalObject frame #5: 0x0000000101c2f5de XUL`XPCJSContextStack::GetSafeJSContext frame #6: 0x0000000101bb17f1 XUL`nsXPConnect::GetSafeJSContext frame #7: 0x0000000101bb181c XUL`_ZThn48_N11nsXPConnect16GetSafeJSContextEv frame #8: 0x00000001017d3d09 XUL`nsScriptSecurityManager::GetSafeJSContext frame #9: 0x00000001017de541 XUL`nsScriptSecurityManager::Init frame #10: 0x00000001017d502b XUL`nsScriptSecurityManager::GetScriptSecurityManager() frame #11: 0x0000000100b7a53d XUL`nsContentUtils::Init() frame #12: 0x000000010065f574 XUL`nsLayoutStatics::Initialize() + 276 frame #13: 0x0000000100653ae1 XUL`Initialize() frame #14: 0x0000000102f9212d XUL`nsComponentManagerImpl::KnownModule::Load frame #15: 0x0000000102f92ca4 XUL`nsFactoryEntry::GetFactory frame #16: 0x0000000102f9370d XUL`nsComponentManagerImpl::CreateInstanceByContractID frame #17: 0x0000000102f8f119 XUL`nsComponentManagerImpl::GetServiceByContractID frame #18: 0x0000000102f93dfa XUL`_ZThn8_N22nsComponentManagerImpl22GetServiceByContractIDEPKcRK4nsIDPPv frame #19: 0x0000000100013bce xpcshell`CallGetService

(In reply to Jan de Mooij [:jandem] from comment #1) > The problem is that JSOPTION_TYPE_INFERENCE has to be set on the cx when we > create the Zone/Compartment, or TI will be disabled even if we set the flag > later. Uh, what? That is bonkers. I can see an argument for it being per-compartment, but being per-zone is pretty much crazy, because we're always going to be creating the system zone (we need to bootstrap stuff with the SafeJSContext, among other things) before we have any idea of what kind of jit flags we want to pass. The JIT should be fixed so that this flag can be per-compartment. And it really shouldn't depend on the cx either, otherwise we're going to run into a lot of trouble when we single-cx Gecko, since that effectively forces everything to use the same jit flags. Once we're in that state of affairs, we just need to pass the appropriate flag to the ensuing call to InitClassesWithNewWrappedGlobal or somesuch.

TI is now enabled unconditionally and bug 939562 moved the JIT flags to the runtime. I verified xpcshell scripts are JITted (with IONFLAGS=scripts and by running some benchmarks).