1063328 - [jsdbg2] Debug mode OSR doesn't correctly handle live iterators on the stack when bailing out in-place due to propagate an exception

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Shu-yu Guo [:shu]]

As a refresher, first consider a call to a function |triggerDebugModeAndThrow()| in Ion. Debug mode OSR will bail out Ion->Baseline in place and resume directly into the baseline exception handler as to deal with onExceptionUnwind. However, this happens before the function itself returns, which means the ResumePoint for the function call is unable to reconstruct the expression stack, which expects the return value of the function to be pushed. For this reason, in-place resumptions due to debug mode currently uses the JS_OPTIMIZED_OUT placeholder for the entire expression stack.

However, now consider the following:

var obj = { foo: 42 };
for (var k in obj)
   triggerDebugModeOSRAndThrow();

There is a live for-in iterator on the stack, which debug mode OSR currently doesn't deal with correctly.

Comment 1

[Shu-yu Guo [:shu]]

Attachment: Fix on-stack live iterator handling when bailing out in-place due to debug mode OSR.

Tests fail with my patches from bug 1032869 landed. I couldn't find a
non-convoluted way to test for this behavior currently.

Comment 2

[Shu-yu Guo [:shu]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1176cc3c3b34

Comment 3

[Ekanan Ketunuti]

https://hg.mozilla.org/mozilla-central/rev/1176cc3c3b34