1495916 - Fix Bailouts in ARM64

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect, P2)

Description

[Sean Stangl [:sstangl]]

Attachment: bailouts.patch

The bailout code in ARM64 was broken, which manifested as a failure on every test that uses "--ion-eager --ion-offthread-compile=off" -- roughly 12,000 jit-test failures.

There were a number of problems. Discovering them took a while. The general strategy used was to place sentinel values on the stack and see how they mismatch with expected locations in the Bailout() handler.

The problems this fixes are:

1. The ARM64 code wasn't actually pushing all the registers, causing an off-by-32 error.
2. The ARM64 code wasn't pushing frameSize_.
3. The bailout handler return code was just wrong.

For testing, it looks like this behaves correctly for basic/FPQuadCmp.js, but unfortunately that test still fails for other reasons that should be addressed elsewhere.

I attempted to leave comments that would be helpful to myself in the case of having to reverse-engineer how this works again.

Comment 1

[Sean Stangl [:sstangl]]

The #ifdef DEBUG code in PushBailoutFrame() isn't needed anymore, since the number of registers pushed is static.

Comment 2

[Sean Stangl [:sstangl]]

Attachment: bug_1495916_fix_bailouts_in_arm64_r_jandem

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/acf3ccc27e1e
Fix bailouts in ARM64. r=jandem

Comment 4

[Raul Gurzau (:RaulG)]

https://hg.mozilla.org/mozilla-central/rev/acf3ccc27e1e