1846122 - createJitRuntime is called even if JIT is disabled

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine: JIT, defect)

Description

[Xi Ruoyao]

Steps to reproduce:

For details see https://gitlab.freedesktop.org/polkit/polkit/-/issues/199.

Actual results:

Even if JIT is disabled via setDisableIon, setWasmIon(false), and setAsmJS(false), createJitRuntime is still called by InitSelfHostedCode. So if W/X mapping is disabled, InitSelfHostedCode will crash.

Expected results:

If JIT is disabled, Spidermonkey (expect JIT) should still function normally even if W/X mapping cannot be created.

Comment 1

[Xi Ruoyao]

(In reply to Xi Ruoyao from comment #0)

Expected results:

If JIT is disabled, Spidermonkey (expect JIT) should still function normally even if W/X mapping cannot be created.

Sorry, I mean "except", not "expect".

Comment 2

[Jan de Mooij [:jandem]]

(In reply to Xi Ruoyao from comment #0)

Even if JIT is disabled via setDisableIon, setWasmIon(false), and setAsmJS(false), createJitRuntime is still called by InitSelfHostedCode. So if W/X mapping is disabled, InitSelfHostedCode will crash.

This doesn't disable all the JITs. You should call JS::DisableJitBackend() before creating the first context/runtime (and before JS_Init*) and that should prevent the engine from reserving JIT memory.

Comment 3

[Xi Ruoyao]

(In reply to Jan de Mooij [:jandem] from comment #2)

(In reply to Xi Ruoyao from comment #0)

Even if JIT is disabled via setDisableIon, setWasmIon(false), and setAsmJS(false), createJitRuntime is still called by InitSelfHostedCode. So if W/X mapping is disabled, InitSelfHostedCode will crash.

This doesn't disable all the JITs. You should call JS::DisableJitBackend() before creating the first context/runtime (and before JS_Init*) and that should prevent the engine from reserving JIT memory.

Indeed it works.