1365769 - [Ion] Fix MToString when it throws due to a Symbol

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Ted Campbell [:tcampbell]]

Attachment: MToString_Symbol.js

If attached example is run with --ion-eager --ion-offthread-compile=off, the TypeError escapes the try block.

Comment 1

[Ted Campbell [:tcampbell]]

In this case, the MToString is marked setMovable, so LICM hoists it outside of the try-block, causing the exception to think it fired at line 4 and does not get caught.

One fix would be to *not* mark setMovable *if* Symbol (or Object) case.

Comment 2

[Ted Campbell [:tcampbell]]

After fixing the code motion problem, the next issue we hit is that when the |ConvertToStringPolicy| of |MNewStringObject| gets applied, we introduce an MToString that has no resume point. This causes |x| to have the wrong value in the catch block.

Comment 3

[Ted Campbell [:tcampbell]]

Attachment: MToString_Symbol-2.js

A further bug occurs when we use JSOP_TOSTRING (via template literals). In this case we are missing the |resumeAfter| in |IonBuilder::jsop_tostring| when |value->mightBeType(MIRType::Symbol)|.

Comment 4

[Ted Campbell [:tcampbell]]

Attachment: Bug 1365769 - MToString should bailout on Symbols

Review commit: https://reviewboard.mozilla.org/r/140718/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/140718/

Comment 5

[Ted Campbell [:tcampbell]]

Proposed fix is to simply bailout on Symbols and have the exception fire off in Baseline instead. This allows us to keep the MToString as movable. If LICM hoists the node, we simply bail out sooner and perform the details in Baseline instead.

Comment 6

[Jan de Mooij [:jandem]]

Comment on attachment 8869095 [details]
Bug 1365769 - MToString should bailout on Symbols

https://reviewboard.mozilla.org/r/140718/#review145110

Good catch, thanks for fixing.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8ed5deec4fc3
MToString should bailout on Symbols r=jandem

Comment 8

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/8ed5deec4fc3